I have always heard "assume the attacker knows your system better than you". If you are relying on the attacker not knowing how some mechanism works you are as

I have always heard "assume the attacker knows your system better than you". If you are relying on the attacker not knowing how some mechanism works you are assuming that nobody is particularly familiar with it. You can use this as a heuristic to determine what parts of your system to focus on protecting, but how effectiveness of this method is entirely dependent on how well you know the system.