I believe the "security by obscurity doesn't work" people fall into two types: - those that are coming from a crypto background, where you frame things as "in p

I believe the "security by obscurity doesn't work" people fall into two types: - those that are coming from a crypto background, where you frame things as "in principle breakable" vs "not breakable, not even in principle" and there's nothing in between, a framework according to which security by obscurity goes into the "in principle breakable" bucket, - people who just mindlessly parrot people of the first type. A more nuanced (and more useful) way of viewing this is one of cost vs reward: How much does it cost an attack to break your thing, and what's the maximum cost that an attacker is lilely to be willing to invest before your thing becomes unappealing. According to this view, obscurity can significantly increase the cost of the attack. It's as simple as that.