4 ms·
People get this wrong a lot. Security only through obscurity is no security at all. The argument was generally made in the context of secret, proprietary encry
by _jal 6y ago
People get this wrong a lot.
Security only through obscurity is no security at all. The argument was generally made in the context of secret, proprietary encryption algorithms. In this context, it was frequently true - security reduced to reverse engineering.
But security isn't a thing. It is a property of a system. And many secure systems strategically employ obscurity for multiple purposes.
Reciting a mantra is a poor substitute for carefully considering your problem domain.
- TedDoesntTalk 6y agoRight, but in the context of this application, there is NO OTHER security except the obscurity of the UUID or it’s hash. The mantra applies quite well here since an attacker could stumble upon a valid hash or UUID and then change the data.
- StavrosK 6y agoThe attacker could stumble upon a valid hash like they could stumble upon a valid password.