Obscurity can be a useful technique for defense in depth, or even just reducing the noise of drive-by attacks to make it easier to identify the “real” ones. For

Obscurity can be a useful technique for defense in depth, or even just reducing the noise of drive-by attacks to make it easier to identify the “real” ones. For example, putting SSH on a non-standard port. But encrypting metadata isn’t “obscurity” at all. It’s strongly protecting sensitive personal information. And it’s table-stakes for a password manager. “Obscurity” refers to obfuscating data in a way that’s easily reversible by knowing a trick or method. Like the FortiNet XOR with a static key. “Secured by a high entropy secret and a trusted algorithm” is not obscurity, unless, for example, the key is packaged with the data it is meant to protect in a cute way.