3 ms·

I wish puzzles would indicate whether it's something language/decimal-notation based, vs something fundamentally mathematical based, before spending time on it

umvi 7y ago
And people say security through obscurity doesn't work! As you can see, it's a very effective time waster that can be layered on top of existing security.
- praptak 7y ago
  For me it's more about avoiding the kind of puzzles I don't like. I would be disappointed if I spent hours on this only to find out the solution is language-based.
- ldoughty 7y ago
  Security through obscurity is not effective in the sense that dedicated attackers, or those with large amounts of resources can _eventually_ crack the code. It gets such bad attention because people NOT in the security field (or aware of security methods) tend to view it as a good line of defense. I've seen implementations where the obscurity was client-side JavaScript that modified the POST. The coder thought this would protect the server from malicious payloads.... Unfortunately the obscurity is lost when you provide all visitors with the function to do the obfuscation.
- weare138 7y ago
  I don't think this would be considered "security through obscurity". Security though obscurity is a security mechanism that relies on a secret only the implementer knows about. Like hiding a key to your house under a specific rock in the yard that only you knows the location of and hopefully isn't discovered by someone else. A puzzle is solvable and would only protect you from people who aren't good at puzzles.
  - umvi 7y ago
    I think it is. You are making the puzzle more difficult to solve by obscuring what the object of the puzzle even is. If you don't even know what the goal is, how can you start solving it? If I gave you an AES-encrypted cipher and told you to crack it, you would at least know what the end goal is (break AES). But if I just said, "crack the following cipher": a13908x91827p93892a... Where would you even start? You could randomly try things, but the layer of obscurity wastes your time such that you don't even know what goal is other than some vague, nebulous "find the hidden message" goal. Then I reveal that the cipher is actually just AES but with a layer of obscurity on top of it using a quirk of the Afrikaans spoken language to transform the cipher into a baffling string.

umvi 7y ago

And people say security through obscurity doesn't work! As you can see, it's a very effective time waster that can be layered on top of existing security.

praptak 7y ago
For me it's more about avoiding the kind of puzzles I don't like. I would be disappointed if I spent hours on this only to find out the solution is language-based.
ldoughty 7y ago
Security through obscurity is not effective in the sense that dedicated attackers, or those with large amounts of resources can _eventually_ crack the code. It gets such bad attention because people NOT in the security field (or aware of security methods) tend to view it as a good line of defense. I've seen implementations where the obscurity was client-side JavaScript that modified the POST. The coder thought this would protect the server from malicious payloads.... Unfortunately the obscurity is lost when you provide all visitors with the function to do the obfuscation.
weare138 7y ago
I don't think this would be considered "security through obscurity". Security though obscurity is a security mechanism that relies on a secret only the implementer knows about. Like hiding a key to your house under a specific rock in the yard that only you knows the location of and hopefully isn't discovered by someone else. A puzzle is solvable and would only protect you from people who aren't good at puzzles.
- umvi 7y ago
  I think it is. You are making the puzzle more difficult to solve by obscuring what the object of the puzzle even is. If you don't even know what the goal is, how can you start solving it? If I gave you an AES-encrypted cipher and told you to crack it, you would at least know what the end goal is (break AES). But if I just said, "crack the following cipher": a13908x91827p93892a... Where would you even start? You could randomly try things, but the layer of obscurity wastes your time such that you don't even know what goal is other than some vague, nebulous "find the hidden message" goal. Then I reveal that the cipher is actually just AES but with a layer of obscurity on top of it using a quirk of the Afrikaans spoken language to transform the cipher into a baffling string.