3 ms·

It's like a painting in front of a safe: - doesn't reduce the security of the safe - ensure you don't advertise "THERE'S A SAFE HERE" to whoever visit your ho

It's like a painting in front of a safe: - doesn't reduce the security of the safe - ensure you don't advertise "THERE'S A SAFE HERE" to whoever visit your house, possibly reducing burglar attempts Now, if you have just the painting over a hole in the wall, you got something wrong...

cthalupa 6y ago
Now, assume that every painting in your house can be checked for a safe behind it in milliseconds (total, for all safes) by the people in your house. Did you actually accomplish anything?
- choward 6y ago
  Yes, let's say you have random people over you don't know (to fix things for example). One of them is a criminal that wants to case your house to see if it's worth bteaking into when you're out of town. If you're with them the whole time they are working, they won't be able to just look behind the painting and your house doesn't become a target. That's assuming of course that the painting isn't too valuable.
  - cthalupa 6y ago
    But that scenario now takes us firmly outside the realms of what we’re discussing here. You’re actively monitoring the actions of people that you know are going to be there. For an Internet facing server, it would be more like an art gallery where you have hidden the safe behind one painting, and the gallery is open 24/7 with no security to stop people from looking behind paintings, where you know a good portion of visitors are going to do so. You can see an identifier for each visitor that looks behind paintings, but many visitors are doing so and the person that comes in to crack the safe might not have been the person who found it.
- riquito 6y ago
  Why would you think it's in milliseconds? Are you generalising on port scanning? You could say that uuid as urls are obscurity, but it's not that fast to break through (and then hopefully you get some kind of protection layer) There's also an additional monetary cost for the attacker, it adds up
  - cthalupa 6y ago
    >Why would you think it's in milliseconds? Are you generalising on port scanning? I am, since that seems to be the primary example used in the original article and the main example being discussed in the comments. I think that's fair, since obscurity does the most to help against non-persistent threats. Persistent threats have targeted you for some reason, and that targeting means they are willing to employ more resources to get through your security. In that situation you should be focusing on adding as many layers of security that you know have protections besides just 'not being known' as you can, especially when there are tools out there that are specific in helping make them known.

cthalupa 6y ago

Now, assume that every painting in your house can be checked for a safe behind it in milliseconds (total, for all safes) by the people in your house. Did you actually accomplish anything?

choward 6y ago
Yes, let's say you have random people over you don't know (to fix things for example). One of them is a criminal that wants to case your house to see if it's worth bteaking into when you're out of town. If you're with them the whole time they are working, they won't be able to just look behind the painting and your house doesn't become a target. That's assuming of course that the painting isn't too valuable.
- cthalupa 6y ago
  But that scenario now takes us firmly outside the realms of what we’re discussing here. You’re actively monitoring the actions of people that you know are going to be there. For an Internet facing server, it would be more like an art gallery where you have hidden the safe behind one painting, and the gallery is open 24/7 with no security to stop people from looking behind paintings, where you know a good portion of visitors are going to do so. You can see an identifier for each visitor that looks behind paintings, but many visitors are doing so and the person that comes in to crack the safe might not have been the person who found it.
riquito 6y ago
Why would you think it's in milliseconds? Are you generalising on port scanning? You could say that uuid as urls are obscurity, but it's not that fast to break through (and then hopefully you get some kind of protection layer) There's also an additional monetary cost for the attacker, it adds up
- cthalupa 6y ago
  >Why would you think it's in milliseconds? Are you generalising on port scanning? I am, since that seems to be the primary example used in the original article and the main example being discussed in the comments. I think that's fair, since obscurity does the most to help against non-persistent threats. Persistent threats have targeted you for some reason, and that targeting means they are willing to employ more resources to get through your security. In that situation you should be focusing on adding as many layers of security that you know have protections besides just 'not being known' as you can, especially when there are tools out there that are specific in helping make them known.