4 ms·

“Security through obscurity” means something like e.g. “uses a bespoke unpublished crypto algorithm, in the hopes that nobody has put in the effort to exploit i

“Security through obscurity” means something like e.g. “uses a bespoke unpublished crypto algorithm, in the hopes that nobody has put in the effort to exploit it yet.” Usually this is a poor choice vs. going with the published industry standard, because crypto is hard to get right, and people rolling their own implementations usually screw it up, making life much easier for dedicated attackers than trying to attack something that people have been trying and failing to breach for years or decades. Software makers for example typically don’t publish the technical details of their anti-piracy code. But this usually doesn’t prevent software that people care about from being “cracked” quickly after release.

blackflame7000 6y ago
Banking Software uses all sorts of security through obscurity. Infact Unisys used to make custom 48bit CPUs for their clearpath OS to make targeting the hardware very difficult without inside knowledge of the chip architecture.
teknopaul 6y ago
You are making the same argument this article is trying to explain to you. Security by Obscurity is not bad because _on its own_ its not enough, its good because coupled with other layers it adds security. I have been told to remove security by obscurity layers from systems by people that don't grok this. Security was, in a few cases, reduced to nothing. Systems that have one industry standard approach only laid totally open on the Internet due to a single misconfiguration or a single CVE being published. Any other layer would have helped, however "insecure", but they were removed due to the misconception that the layers themselves were "insecure". I would go so far as to say the first layer should always be security by obscurity for any unique system. If you fire up a web server and have the first security requirement that each http request must have the header X-Wibble:wobble I promise you this layer of security will be working hard all day long. Cheap, impossible to get wrong, it's not sufficient but it works.

blackflame7000 6y ago

Banking Software uses all sorts of security through obscurity. Infact Unisys used to make custom 48bit CPUs for their clearpath OS to make targeting the hardware very difficult without inside knowledge of the chip architecture.

teknopaul 6y ago

You are making the same argument this article is trying to explain to you. Security by Obscurity is not bad because _on its own_ its not enough, its good because coupled with other layers it adds security. I have been told to remove security by obscurity layers from systems by people that don't grok this. Security was, in a few cases, reduced to nothing. Systems that have one industry standard approach only laid totally open on the Internet due to a single misconfiguration or a single CVE being published. Any other layer would have helped, however "insecure", but they were removed due to the misconception that the layers themselves were "insecure". I would go so far as to say the first layer should always be security by obscurity for any unique system. If you fire up a web server and have the first security requirement that each http request must have the header X-Wibble:wobble I promise you this layer of security will be working hard all day long. Cheap, impossible to get wrong, it's not sufficient but it works.