5 ms·

Why do so many people still believe in security-by-obscurity? "Some security experts say that studying the source code of a product would make it far easier

Why do so many people still believe in security-by-obscurity? "Some security experts say that studying the source code of a product would make it far easier for a reviewer to spot vulnerabilities in the code, even if they did not leave the site with a copy of the code." I would like to meet those experts that advocate, that not looking at the code makes the product more secure.

chicob 9y ago
Exactly. Although I believe SBO does work, this is simply not the case for using it.
- dsfyu404ed 9y ago
  SBO buys time. "POSTing a script that looks like a custom FORTRAN-esque language" probably sounds a lot like "slower than expected progress" in Russian. All cyber-security is just a way of buying time. Depth is king. The attacker must be made to fight for every inch. However long it takes a new hire to be able to do useful things is about how long it takes an attacker to do useful things without being bull in a China shop loud about it (this is also why key rotation is important). Good attackers deserve credit though. They have to understand stacks that most of HN would just wrap and treat as a black box (and then pull their hair out wondering why their JS app breaks on edge cases).
duncan_bayne 9y ago
> I would like to meet those experts that advocate, that not looking at the code makes the product more secure. Pretty much every proprietary platform vendor ever.
yaps8 9y ago
Well, if you compare the situation where an adversary has access to source code with a situation where they don't - everyting else being the same - , they have higher chance of finding vulnerabilities in the first. The "security-by-obscurity" point does apply when you compare "going open-source with many observers" to "being closed-source with no one looking", but this is not the case here.
- inetknght 9y ago
  ...now enter fuzz testing and your first statement goes out the window.
  - evgen 9y ago
    Fuzz testing is far, far easier and more complete if you have the source code. It is not required to have the source to fuzz, but white-box fuzzing can be combined with code coverage analysis to make sure you hit all code paths, including ones that would rely upon a more structured sequencing of the inputs. Black-box fuzzing could eventually reach the same end result, but it would take far longer or far more resources.
bryanrasmussen 9y ago
security by obscurity does not make something secure, but it does make it more difficult to figure out what security holes something has. Which is what the experts said - if I give you the source code you can figure out my thinking and what attacks to start up. otherwise you have to run a bunch of stuff first and expend resources and money to get to the same spot you can get to just by reading for a bit.
willvarfar 9y ago
Yes, although access to the system allows you to probe it without necessarily alerting the defenders; you can prepare your zero-day and learn from all the crashes and other things that the defenders might have noticed etc.

chicob 9y ago

Exactly. Although I believe SBO does work, this is simply not the case for using it.

dsfyu404ed 9y ago
SBO buys time. "POSTing a script that looks like a custom FORTRAN-esque language" probably sounds a lot like "slower than expected progress" in Russian. All cyber-security is just a way of buying time. Depth is king. The attacker must be made to fight for every inch. However long it takes a new hire to be able to do useful things is about how long it takes an attacker to do useful things without being bull in a China shop loud about it (this is also why key rotation is important). Good attackers deserve credit though. They have to understand stacks that most of HN would just wrap and treat as a black box (and then pull their hair out wondering why their JS app breaks on edge cases).

duncan_bayne 9y ago

> I would like to meet those experts that advocate, that not looking at the code makes the product more secure. Pretty much every proprietary platform vendor ever.

yaps8 9y ago

Well, if you compare the situation where an adversary has access to source code with a situation where they don't - everyting else being the same - , they have higher chance of finding vulnerabilities in the first. The "security-by-obscurity" point does apply when you compare "going open-source with many observers" to "being closed-source with no one looking", but this is not the case here.

inetknght 9y ago
...now enter fuzz testing and your first statement goes out the window.
- evgen 9y ago
  Fuzz testing is far, far easier and more complete if you have the source code. It is not required to have the source to fuzz, but white-box fuzzing can be combined with code coverage analysis to make sure you hit all code paths, including ones that would rely upon a more structured sequencing of the inputs. Black-box fuzzing could eventually reach the same end result, but it would take far longer or far more resources.

bryanrasmussen 9y ago

security by obscurity does not make something secure, but it does make it more difficult to figure out what security holes something has. Which is what the experts said - if I give you the source code you can figure out my thinking and what attacks to start up. otherwise you have to run a bunch of stuff first and expend resources and money to get to the same spot you can get to just by reading for a bit.

willvarfar 9y ago

Yes, although access to the system allows you to probe it without necessarily alerting the defenders; you can prepare your zero-day and learn from all the crashes and other things that the defenders might have noticed etc.