4 ms·

I don't know if I agree. While obscurity can be a deterrent, I imagine most groups are unlikely to come up with sufficient, convoluted complexity to prevent ide

I don't know if I agree. While obscurity can be a deterrent, I imagine most groups are unlikely to come up with sufficient, convoluted complexity to prevent identification of exploits. Primarily because you're effectively pitting yourself against a collective of $hat hackers, instead of doing things "right" and attempting to use encryption. This doesn't mean it isn't a deterrent, but doing things in an obfuscated and unusual way also means you're potentially treading on unexplored ground, and so there will potentially be other exploits, bugs, innefficiencies which can come with the territory.

monocasa 8y ago
This isn't an "instead of doing things 'right'". Like I said, it's only valid as one component of a broader strategy. You might have a point if someone had ever made a perfect scheme, but everything that seems to have attracted attention has been broken AFAICT. So, a moat around a castle does help. Calling it good after digging a moat and not building any walls is probably less useful than doing nothing. The moat is only useful in the broader context.
- lostapathy 8y ago
  Conversely, sometimes the obscurity layer will obscure the issues not just from others, but also yourself. I worked for a thin client vendor years ago that was obsessed with encrypting our boot image etc, and poured all our resources into that. Which lead to encryption that was still trivial to work around, and a lot of other real security issues were never dealt with because we were fixated on the ineffective obscurity layer.
  - monocasa 8y ago
    That just sounds like misplaced priorities than the obfuscation layer getting in the way.
    - lostapathy 8y ago
      Absolutely. The obsession with that obfuscated our priorities, 100%. It also made our images more insecure, because it added no real security, while making it harder to improve security where it mattered.

monocasa 8y ago

This isn't an "instead of doing things 'right'". Like I said, it's only valid as one component of a broader strategy. You might have a point if someone had ever made a perfect scheme, but everything that seems to have attracted attention has been broken AFAICT. So, a moat around a castle does help. Calling it good after digging a moat and not building any walls is probably less useful than doing nothing. The moat is only useful in the broader context.

lostapathy 8y ago
Conversely, sometimes the obscurity layer will obscure the issues not just from others, but also yourself. I worked for a thin client vendor years ago that was obsessed with encrypting our boot image etc, and poured all our resources into that. Which lead to encryption that was still trivial to work around, and a lot of other real security issues were never dealt with because we were fixated on the ineffective obscurity layer.
- monocasa 8y ago
  That just sounds like misplaced priorities than the obfuscation layer getting in the way.
  - lostapathy 8y ago
    Absolutely. The obsession with that obfuscated our priorities, 100%. It also made our images more insecure, because it added no real security, while making it harder to improve security where it mattered.