4 ms·

Defense in depth. I don't care if the first level of defense is a speedbump. I don't absolutely depend on it, but why should I _not_ put the speedbump there wh

Defense in depth. I don't care if the first level of defense is a speedbump. I don't absolutely depend on it, but why should I _not_ put the speedbump there when it is so cheap and easy.

teddyh 6y ago
Because speedbumps are annoying to everybody, and wastes everybody’s time with unnecessary complications.
- zymhan 6y ago
  It is trivial to specify the SSH port number
  - thinkharderdev 6y ago
    It is trivial if you actually know what the port number is and you are only talking to one server and the non-22 port is static. Now imagine you have code that is connecting to thousands of different servers on different ports and they can change at any time if someone who owns one of those servers decides to rebuild their machine and changes the SSH port. Nothing is trivial at scale. That's not say that is always a valid consideration but standards and conventions exist for a reason.
staticassertion 6y ago
The reason is because obscure things tend to be less well understood. SSH port being on another port isn't a case of that, but it isn't security by obscurity. Security by obscurity might be "I use a non standard PDF viewer, therefor I am safer". But a non-standard PDF viewer may also be subject to less auditing, may not have pressure to improve its security, etc. It's an unknown both to the attacker but also to you. This is where security through obscurity is actually a problem. It also makes it harder to threat model. Do you consider your obscurity as a mitigation when you consider threats to your system? It leads to the temptation of "well, but the attacker would have to know that I'm using this PDF viewer", and then you start to treat that as a mitigating factor. It can be a dangerous thing. Secrets are not obscurity. Randomness is not obscurity. People seem to make that mistake the most.
lmm 6y ago
It's not cheap, you're paying for it every time someone new has to log in and you have to explain your setup. For that price you could do a real security measure like public-key only login.

Defense in depth. I don't care if the first level of defense is a speedbump. I don't absolutely depend on it, but why should I _not_ put the speedbump there when it is so cheap and easy.

teddyh 6y ago

Because speedbumps are annoying to everybody, and wastes everybody’s time with unnecessary complications.

zymhan 6y ago
It is trivial to specify the SSH port number
- thinkharderdev 6y ago
  It is trivial if you actually know what the port number is and you are only talking to one server and the non-22 port is static. Now imagine you have code that is connecting to thousands of different servers on different ports and they can change at any time if someone who owns one of those servers decides to rebuild their machine and changes the SSH port. Nothing is trivial at scale. That's not say that is always a valid consideration but standards and conventions exist for a reason.

staticassertion 6y ago

The reason is because obscure things tend to be less well understood. SSH port being on another port isn't a case of that, but it isn't security by obscurity. Security by obscurity might be "I use a non standard PDF viewer, therefor I am safer". But a non-standard PDF viewer may also be subject to less auditing, may not have pressure to improve its security, etc. It's an unknown both to the attacker but also to you. This is where security through obscurity is actually a problem. It also makes it harder to threat model. Do you consider your obscurity as a mitigation when you consider threats to your system? It leads to the temptation of "well, but the attacker would have to know that I'm using this PDF viewer", and then you start to treat that as a mitigating factor. It can be a dangerous thing. Secrets are not obscurity. Randomness is not obscurity. People seem to make that mistake the most.

lmm 6y ago

It's not cheap, you're paying for it every time someone new has to log in and you have to explain your setup. For that price you could do a real security measure like public-key only login.