I like to say that obscurity should not be used _for_ security but in _addition_ to security. For example running ssh on a non-default port. It's obscurity. Bu

I like to say that obscurity should not be used _for_ security but in _addition_ to security. For example running ssh on a non-default port. It's obscurity. But it should still have correct key strengths and all the settings as if it was running on the default port. It shouldn't be weakened somehow because it is running on that port. So why run it on a non-default port, then? Perhaps to get less log noise. So it doesn't add to security but it makes parsing the logs easier, because it's less stuff to search through.