4 ms·

In DC there is this concept of "the blob" which is basically shorthand for "The Washington consensus that isn't verifiable, but that most people parrot since to

In DC there is this concept of "the blob" which is basically shorthand for "The Washington consensus that isn't verifiable, but that most people parrot since to hold an opposing view doesn't really get you anything because even if you're right, nobody will remember. All that they'll remember is that you're that weird guy that looks at stuff with a strange perspective and that you may be too dense to social signal that you're in the blob." I've noticed the same thing with software developers. - "Client side encryption in JavaScript is useless!" Until CloudBleed came out and the only company that was safe was a password manager that used it. To thwart client side encryption you need to actually modify the contents of the JS payload, which is detectable. But no matter how much evidence I give that this tactic works and is actually used in production and that it actually stops attacks, programmers just don't care. - "Don't do security by obscurity!" But then we all implement passwords (which is just security by obscurity) and the best people in intelligence don't have LinkedIn accounts. Anyone can join an OSINT forum and see the actual tools that get used. Security by obscurity works for many, many actors. There are many, many little bits of stuff like this. Think to yourself: How many times has code that you've written lead to an RCE vuln that was exploited. Personally, I can only give a lower bound, and that lower bound is zero because I'm extremely careful, but I don't pretend that it's never happened. Anyone that is familiar with data science or economics or political economy understands that when a signal is dampened the response is dampened.

Spivak 6y ago
> "Don't do security by obscurity!" But then we all implement passwords (which is just security by obscurity) Thank you for being someone else who recognizes this. If having a secret piece of knowledge grants you access to the system then it's obscurity. Once we admit that then we can start talking about the difficulty of guessing that knowledge as the actual important factor.
- jlgaddis 6y ago
  > If having a [password] grants you access to the system then it's obscurity. Perhaps if you're hiding it under the doormat in front of the door and expecting it won't be found. Or writing your PIN on your ATM card with a sharpie and leaving it on the dash of your car with the doors unlocked and your windows down. In most cases, however, it's part of an overall system that involves authentication, authorization, and (hopefully!) accounting to protect access to resources.
josephcsible 6y ago
> But then we all implement passwords (which is just security by obscurity) No it isn't. Security by obscurity is explicitly keeping things other than passwords and keys secret.
- Spivak 6y ago
  I feel like it's a pretty weak point to say that passwords and keys would be security by obscurity if we didn't carve out a special exception for them. Why do they get a special exception? Because they're really really hard to guess, not because they're fundamentally different. Let me give a real-life example of a good non-password, non-key piece of secret information that's used for authentication. If you need to recover a WoW account that you've lost access to the customer service reps will ask you to tell them the names of the characters on the account. Your account name isn't secret, and your character names aren't secret. But the relationship is because they aren't ever publicly connected. The odds that someone other than the account owner having this information is low and the odds of guessing it by chance is impossible.
  - floe 6y ago
    They're verifiably hard to guess. That is fundamentally different. (At least when passwords are generated with enough entropy.)
    - Spivak 6y ago
      But does that make them different or are they just things that are easy to verify? If you could calculate the entropy of another authentication scheme would it be included? The danger of security by obscurity is that your system might not have as much entropy as you initially estimate and can be easily defeated. Sounds a lot like the vulnerabilities in normal crypo applications, right?
  - hannasanarion 6y ago
    Security by obscurity refers to obscuring the design of a system, not obscuring credentials. Hiding your password isn't security through obscurity. Hiding the fact that you need to say a password to get into a building is. Protecting your encryption keys isn't security through obscurity. Hiding which encryption algorithm you are using is.

Spivak 6y ago

> "Don't do security by obscurity!" But then we all implement passwords (which is just security by obscurity) Thank you for being someone else who recognizes this. If having a secret piece of knowledge grants you access to the system then it's obscurity. Once we admit that then we can start talking about the difficulty of guessing that knowledge as the actual important factor.

jlgaddis 6y ago
> If having a [password] grants you access to the system then it's obscurity. Perhaps if you're hiding it under the doormat in front of the door and expecting it won't be found. Or writing your PIN on your ATM card with a sharpie and leaving it on the dash of your car with the doors unlocked and your windows down. In most cases, however, it's part of an overall system that involves authentication, authorization, and (hopefully!) accounting to protect access to resources.

josephcsible 6y ago

> But then we all implement passwords (which is just security by obscurity) No it isn't. Security by obscurity is explicitly keeping things other than passwords and keys secret.

Spivak 6y ago
I feel like it's a pretty weak point to say that passwords and keys would be security by obscurity if we didn't carve out a special exception for them. Why do they get a special exception? Because they're really really hard to guess, not because they're fundamentally different. Let me give a real-life example of a good non-password, non-key piece of secret information that's used for authentication. If you need to recover a WoW account that you've lost access to the customer service reps will ask you to tell them the names of the characters on the account. Your account name isn't secret, and your character names aren't secret. But the relationship is because they aren't ever publicly connected. The odds that someone other than the account owner having this information is low and the odds of guessing it by chance is impossible.
- floe 6y ago
  They're verifiably hard to guess. That is fundamentally different. (At least when passwords are generated with enough entropy.)
  - Spivak 6y ago
    But does that make them different or are they just things that are easy to verify? If you could calculate the entropy of another authentication scheme would it be included? The danger of security by obscurity is that your system might not have as much entropy as you initially estimate and can be easily defeated. Sounds a lot like the vulnerabilities in normal crypo applications, right?
- hannasanarion 6y ago
  Security by obscurity refers to obscuring the design of a system, not obscuring credentials. Hiding your password isn't security through obscurity. Hiding the fact that you need to say a password to get into a building is. Protecting your encryption keys isn't security through obscurity. Hiding which encryption algorithm you are using is.