2 ms·
All software security comes down to obscurity: it depends on the selection of specific numbers that are known to the authorized parties, but are extremely diffi
by snowwrestler 6y ago
All software security comes down to obscurity: it depends on the selection of specific numbers that are known to the authorized parties, but are extremely difficult to guess (i.e. very obscure) to the unauthorized parties.
The extreme of this strategy is to make a successful guess cost more than anyone can possibly pay, for example by using numbers so obscure that all known algorithms for guessing them will take longer than the heat death of the universe to succeed, or something like that.
But while there seems to be solid math to calculate such numbers, implementations are rarely perfect and can easily leave open the possibility of other guesses that cost a lot less than breaking the theoretical limit. (AKA side channels, vulnerabilities, bugs, etc)
Where "security by obscurity" comes in for criticism, it's usually because the implementers have misjudged the amount of obscurity they are actually creating, or misjudged the amount they need (their threat model), or both.
It's easy to make these mistakes because it is hard to create perfect implementations, and hard to know exactly the current and future capabilities of your attackers.
- iso8859-1 6y agoSecurity can also be achieved by physical separation or identity based on physical human traits. Now we're getting philosophical, but if the security crew of the data center knows my face, and does not allow other people to enter, would you reduce my face to a value that is "extremely difficult to guess"?
- bosswipe 6y agoRight. There are three types of authentication factors: something you know, something you have, something you are. Obscurity and passwords fall under "something you know". Biometrics like what you describe would fall under "something you are". A physical key such as a yubikey or the sim card matching an SMS challenge would be "something you have". Multi-factor authentication is more secure but it doesn't negate the discussion here about hardening the "something you know" factor.
- chrononaut 6y agoWhat's interesting is that (mostly impractical at the moment) attacks on biometrics authentication mechanisms end up summarizing that category to also "something you have", rather than "something you are" -- not that it negate its particular utility.
- EmilioMartinez 6y agoJust playing OP's advocate here, he did say "software security", as in security through software. I'm sure there's another counter-example though.
- SahAssar 6y ago> All software security comes down to obscurity Isn't this the same as saying something like all astronomy is a matter of looking at the right place? Or all math is solving an equation? Or all surgery is cutting the right thing? If you reduce anything to it's simplest part, it will sound simple.