3 ms·
> obscurity is a totally valid tactic to impose additional costs on attackers But there's the rub: you'll only impose additional costs to the least sophisticat
by zdkl 7y ago
> obscurity is a totally valid tactic to impose additional costs on attackers
But there's the rub: you'll only impose additional costs to the least sophisticated/determined adversaries. While that works to keep random scriptkiddies/scans out, I'd argue it has little to no effect if you require serious security guarantees.
- zwirbl 7y agoAt least the bar for entry is a little bit higher, this in itself might be worth it then
- maxbond 7y agoIt imposes costs on all attackers. The value of that cost is skill dependent, but no one has unlimited time on their hands. In other contexts, like hiding an admin login page, shutting out low skill attackers means your log files have better signal to noise, and you can focus more resources on the more significant threats. The reason I say to think of it as a preemptive strike rather than a defense is that you still do need strong defensive layers. This is basically just setting a compiler flag. It's free for you and costs something for the attacker.