It's an interesting question. For me, the difference is that obscurity strategies are ad-hoc and unproven and perhaps unprovable. We should be able to make a st

It's an interesting question. For me, the difference is that obscurity strategies are ad-hoc and unproven and perhaps unprovable. We should be able to make a strong argument that our systems have particular security properties, such as asymmetric costs. So, asking how much entropy is "obscurity" and how much is "security" is the wrong question. If you can measure the amount of entropy, you're already in the "security" sphere, and you're talking about security and insecurity. For instance, if you invent your own passwords rather than using a password generator, and you use an ad-hoc strategy without employing any sort of reasoning about how much entropy you're generating, I think it is fair to say you're employing obscurity. For the initiated, it is not reasonable to expect this strategy to do better than "hunter2". "Security", in this case, would be using a password generator or some other strategy that we can reasonably believe is sound. You seem to be arguing for something provable which you can reason about mathematically, and not something ad-hoc which we cannot be certain of. If you happen to see my response and read the whole thing, then I pose to you a second question; is creating a fake copy of your data, which you do not protect as carefully as your real data, a security or obscurity strategy? Or something else entirely?