3 ms·

> You didn’t replace the service’s security with this layer, you simply added it to what already existed. Remember, the NSA most likely has great algorithms, bu

by x1798DE 10y ago

> You didn’t replace the service’s security with this layer, you simply added it to what already existed. Remember, the NSA most likely has great algorithms, but they still don’t publish them. I feel like this is a great example of why this "obscurity as a security layer" is misleading, to say the least. Having a "great algorithm" that you don't publish is bad for the same reason security by obscurity is bad - there are fewer people criticizing and tempering the algorithms you use. This feeds into the idea that "anyone can make cryptography they can't crack" (NSA or not). The problem with these "obscurity as a valid security layer" arguments is that there's already obscurity built into these protocols. The algorithm is open, the key (or password) is kept obscure. Adding some non-standard flourishes on top of a secure protocol is basically just using an insecure protocol (security by obscurity) to "extra" secure an already secure protocol. The point being that the overall security of the system is not meaningfully increased by these actions. That said, I understand why you'd want to use a non-standard SSH port or port knocking or something to reduce noise on your logs.

thingexplainer 10y ago
> ... the key (or password) is kept obscure... I often think about this, and the conclusion I've come to is secret != obscure. Obscurity describes information you do not know but can research to determine; secret describes information you do not know but and must guess. But I agree that the argument that the NSA probably uses obscurity (I speculate to make messages harder to attribution to them and not to protect the secrecy of the content) isn't very moving.
danielrm26 10y ago
Think of security as reducing risk. If you're invisible your risk is lower because you have a lower chance of being targeted. This is wholly separate from what happens if you're hit. That's resilience, or armor, or whatever we want to call that. But both reducing the probability of being a target and being more resilient once you are a target qualify as security.
- x1798DE 10y ago
  This is not invisiblity. It's putting your safe door behind a curtain. Yes, fewer people are seeing the safe, but the curtain is not actually increasing your security, it's just preventing casual attackers from seeing you as a target of opportunity (who, for the most part, are also not going to get past real security, anyway). I don't know that it's dangerous, but it's not really additional meaningful security, in my opinion, so long as it has zero downsides. The example of the NSA keeping their algorithm hidden does have downsides. One of the biggest downsides of doing some non-standard thing is that you might not realize that you are actually weakening your security. If you have some protocol that involves not revealing the existence of a server to casual attackers, that's completely fine with me, but it's worth noting how easily these things can get conflated together.
  - danielrm26 10y ago
    It's the same as cloaking a tank in a tank battle. If you didn't take the armor off it's great. But if you did then you've put your eggs in the don't get hit basket. The trick is figuring out if you could have bought more armor with the money you spent on the cloaking device. Or, if enemy weapons are so good that armor doesn't matter, then it's time to think about cloaking very seriously. It's a balance between probability and impact. With cloaking you're reducing likelihood. With armor you're reducing impact. But in both cases you're reducing risk.

by x1798DE 10y ago

thingexplainer 10y ago

> ... the key (or password) is kept obscure... I often think about this, and the conclusion I've come to is secret != obscure. Obscurity describes information you do not know but can research to determine; secret describes information you do not know but and must guess. But I agree that the argument that the NSA probably uses obscurity (I speculate to make messages harder to attribution to them and not to protect the secrecy of the content) isn't very moving.

danielrm26 10y ago

Think of security as reducing risk. If you're invisible your risk is lower because you have a lower chance of being targeted. This is wholly separate from what happens if you're hit. That's resilience, or armor, or whatever we want to call that. But both reducing the probability of being a target and being more resilient once you are a target qualify as security.

x1798DE 10y ago
This is not invisiblity. It's putting your safe door behind a curtain. Yes, fewer people are seeing the safe, but the curtain is not actually increasing your security, it's just preventing casual attackers from seeing you as a target of opportunity (who, for the most part, are also not going to get past real security, anyway). I don't know that it's dangerous, but it's not really additional meaningful security, in my opinion, so long as it has zero downsides. The example of the NSA keeping their algorithm hidden does have downsides. One of the biggest downsides of doing some non-standard thing is that you might not realize that you are actually weakening your security. If you have some protocol that involves not revealing the existence of a server to casual attackers, that's completely fine with me, but it's worth noting how easily these things can get conflated together.
- danielrm26 10y ago
  It's the same as cloaking a tank in a tank battle. If you didn't take the armor off it's great. But if you did then you've put your eggs in the don't get hit basket. The trick is figuring out if you could have bought more armor with the money you spent on the cloaking device. Or, if enemy weapons are so good that armor doesn't matter, then it's time to think about cloaking very seriously. It's a balance between probability and impact. With cloaking you're reducing likelihood. With armor you're reducing impact. But in both cases you're reducing risk.