2 ms·
I can't believe the discussion is this long and someone hasn't said 'security by obscurity' yet. Personally, if I was trying to prevent a break-in to a buildin
by code_duck 6y ago
I can't believe the discussion is this long and someone hasn't said 'security by obscurity' yet.
Personally, if I was trying to prevent a break-in to a building, I would think it was a great advantage if the attackers had to work hard to even figure out where the doors and windows were.
- doublesCs 6y agoI believe the "security by obscurity doesn't work" people fall into two types: - those that are coming from a crypto background, where you frame things as "in principle breakable" vs "not breakable, not even in principle" and there's nothing in between, a framework according to which security by obscurity goes into the "in principle breakable" bucket, - people who just mindlessly parrot people of the first type. A more nuanced (and more useful) way of viewing this is one of cost vs reward: How much does it cost an attack to break your thing, and what's the maximum cost that an attacker is lilely to be willing to invest before your thing becomes unappealing. According to this view, obscurity can significantly increase the cost of the attack. It's as simple as that.