I'd argue that all security is security by obscurity, it is just a question of how many attacker-seconds it takes to break. Obscurity means keeping something p

I'd argue that all security is security by obscurity, it is just a question of how many attacker-seconds it takes to break. Obscurity means keeping something private that if the attacker knew they could access your service. Traditionally security by obscurity is something like putting your ssh login port on port 61329 rather than port 22. I'd argue that the above is 16 bits of obscurity, whereas your ssh key you log in with is 1024 bits of obscurity. The attacker needs that 16 bits of port number obscurity and the 1024 bits of ssh key obscurity to log in. However the attacker-seconds to break the 16 bit port number is a rounding error compared to the attacker-seconds to break the 1024 bit ssh key Which is where, I guess, the idea that "security through obscurity" is bad came from. I'd argue that the attacker-seconds is still higher with your ssh on port 61329 though, so why not use that too.