5 ms·

To me this seems like a bit of a strawman argument. The claim was never that using obscurity is bad and should be avoided. As I first heard it, "Security throu

To me this seems like a bit of a strawman argument. The claim was never that using obscurity is bad and should be avoided. As I first heard it, "Security through obscurity is not security" is saying that if you are relying on obscurity to keep your stuff secure then you aren't doing enough. I think this is still true and the conclusion of the article agrees Security by obscurity is not enough by itself. You should always enforce the best practices.

daitangio 6y ago
I agree. Obscurity is a weak strategy. If you can make obscurity not necessary you will gain far better results.
- daneel_w 6y ago
  It's not a strategy. It's a tactic. And as many others in this discussion have pointed out, people who recommend to use obscurity never tell others to let their whole security strategy hinge on it. It's just a useful tool; a tactic.
formerly_proven 6y ago
> The claim was never that using obscurity is bad and should be avoided. Yet. All of these are from HN. > 3. Since when is obscurity a valid security measure? > Security through obscurity, not a valid security plan. > The problem with these "obscurity as a valid security layer" arguments is that there's already obscurity built into these protocols. > Especially since most people believe "Obscurity" to still be a valid security technique. > You're just reciting the same tired old rhetoric that security through obscurity is a valid defense mechanism. It's just not. > I thought the general consensus here is that security by obscurity is bad. > Obscurity is bad because it makes you _think_ it adds security. > To maybe give some perspective _why_ security people say that security by obscurity is bad - and especially serving ssh via port 64323: [...] > I dismissed it as security through (bad) obscurity but is there a valid security reason to do this? > Compression is not encryption and security by obscurity is bad practice. > it's understood that security by obscurity is bad. > Security by obscurity is bad, of course, but in that model it's such a minor factor. And countless many more. Some of these reference "security by obscurity", which, if you're kind, you can interpret as "security only through obscurity" (though reading in context this mostly doesn't seem to be what is meant), while others dismiss obscurity entirely. You will also regularly find commenters lament this point of view as the "mainstream idiocy".
- hackinthebochs 6y ago
  It helps to remember that nuance is lost over time as recommendations of best practices become memes. It's useful to reiterate the valuable nuance on occasion to be sure people aren't just taking the memes at face value, as you can be sure some amount of people are.
- Sebb767 6y ago
  > Obscurity is bad because it makes you _think_ it adds security. I agree with the OP, but I also fully agree with this point. I've seen people download the fishiest stuff or open anything because "I have an antivirus installed". Now, I don't claim that no AV would be better in all cases, but it is very much a factor.
  - magicalhippo 6y ago
    But it's not like that is it. Try to guess the model number written on my monitor. I'll wait...
meowfly 6y ago
There is a bit of a debate here. Apache docs state ServerTokens should not be set to anything less than minimal(https://httpd.apache.org/docs/2.4/mod/core.html#servertokens https://httpd.apache.org/docs/2.4/mod/core.html#servertokens) which contradicts the OWasp recommendation (https://wiki.owasp.org/index.php/SCG_WS_Apache#Server_Token_Directive https://wiki.owasp.org/index.php/SCG_WS_Apache#Server_Token_...). From Apache docs: > Also note that disabling the Server: header does nothing at all to make your server more secure. The idea of "security through obscurity" is a myth and leads to a false sense of safety.

daitangio 6y ago

I agree. Obscurity is a weak strategy. If you can make obscurity not necessary you will gain far better results.

daneel_w 6y ago
It's not a strategy. It's a tactic. And as many others in this discussion have pointed out, people who recommend to use obscurity never tell others to let their whole security strategy hinge on it. It's just a useful tool; a tactic.

formerly_proven 6y ago

> The claim was never that using obscurity is bad and should be avoided. Yet. All of these are from HN. > 3. Since when is obscurity a valid security measure? > Security through obscurity, not a valid security plan. > The problem with these "obscurity as a valid security layer" arguments is that there's already obscurity built into these protocols. > Especially since most people believe "Obscurity" to still be a valid security technique. > You're just reciting the same tired old rhetoric that security through obscurity is a valid defense mechanism. It's just not. > I thought the general consensus here is that security by obscurity is bad. > Obscurity is bad because it makes you _think_ it adds security. > To maybe give some perspective _why_ security people say that security by obscurity is bad - and especially serving ssh via port 64323: [...] > I dismissed it as security through (bad) obscurity but is there a valid security reason to do this? > Compression is not encryption and security by obscurity is bad practice. > it's understood that security by obscurity is bad. > Security by obscurity is bad, of course, but in that model it's such a minor factor. And countless many more. Some of these reference "security by obscurity", which, if you're kind, you can interpret as "security only through obscurity" (though reading in context this mostly doesn't seem to be what is meant), while others dismiss obscurity entirely. You will also regularly find commenters lament this point of view as the "mainstream idiocy".

hackinthebochs 6y ago
It helps to remember that nuance is lost over time as recommendations of best practices become memes. It's useful to reiterate the valuable nuance on occasion to be sure people aren't just taking the memes at face value, as you can be sure some amount of people are.
Sebb767 6y ago
> Obscurity is bad because it makes you _think_ it adds security. I agree with the OP, but I also fully agree with this point. I've seen people download the fishiest stuff or open anything because "I have an antivirus installed". Now, I don't claim that no AV would be better in all cases, but it is very much a factor.
- magicalhippo 6y ago
  But it's not like that is it. Try to guess the model number written on my monitor. I'll wait...

meowfly 6y ago

There is a bit of a debate here. Apache docs state ServerTokens should not be set to anything less than minimal(https://httpd.apache.org/docs/2.4/mod/core.html#servertokens https://httpd.apache.org/docs/2.4/mod/core.html#servertokens) which contradicts the OWasp recommendation (https://wiki.owasp.org/index.php/SCG_WS_Apache#Server_Token_Directive https://wiki.owasp.org/index.php/SCG_WS_Apache#Server_Token_...). From Apache docs: > Also note that disabling the Server: header does nothing at all to make your server more secure. The idea of "security through obscurity" is a myth and leads to a false sense of safety.