I can't tell you how many times I've seen someone say doing something for obscurity shouldn't even be done because of the adage. Some of these adages are really

I can't tell you how many times I've seen someone say doing something for obscurity shouldn't even be done because of the adage. Some of these adages are really harmful. InfoSec has very much gotten a bunch of these statements that can't be argued with, and people won't even take you seriously if you point out the flaws with password managers or PKI. I've definitely used methods in my own code which "aren't trustworthy" from a security doctrine standpoint, but proven near 100% effective, on their own. Just because a state actor won't be phased by it doesn't mean it isn't a strategy that'll prevent 99% of automated attacks.