5 ms·

This article engages in quite a bit of mental gymnastics to avoid calling this tactic exactly what it is. Security by obscurity What are you doing here? SSH ge

This article engages in quite a bit of mental gymnastics to avoid calling this tactic exactly what it is. Security by obscurity What are you doing here? SSH generally runs on port 22. You move it to an alternate port to thwart a naive intruder's attempt to establish a connection to a service running on that port. You are still running SSH with the same old setup. If it was insecure before it remains insecure. The only thing you've done is "obscure" how to connect to it by using an uncommonly used port. Why all the hate on "Security by Obscurity" It's a perfectly valid thing to do. It will definitely defend against a host of intrusion attempts. Its only cast in a negative light when it's the ONLY thing you do or if you consider it sufficient in terms of security. FWIW the key analogy is broken. Hiding a key to your house in a plant is a form of "Security by Obscurity". Anyone that finds the key can open the door. Thats not very secure. So we hide the key so no only people that know where it is can find it. If an intruder found the key they'd immediately have access to the house. We rely on the obscurity of its location to provide whatever security it has to offer. You could achieve the same affect by having a hidden door and leaving the key out in the open or hiding both. What use is the key if the location of the door it opens is "obscure". This works because access is defined by knowing the location of the key and the door simultaneously. Both are examples of "Security by Obscurity"

kristopolous 6y ago
The parent changed his message so this is no longer in direct response but it's probably still valuable: By that logic so are passwords and the key itself, You simply have an "obscured" notch configuration on the grooves of the key. My ssh private key is also just a very uncommon sequence of bytes! It's all encompassing. So either your interpretation needs works, keys and passwords are insecure, or obscurity is actually totally fine.
- opless 6y ago
  That's incredibly tenuous. Also I don't think you know much about asymmetric encryption or the SSH protocol either.
  - deleted 6y ago
    [deleted]
  - kristopolous 6y ago
    So if I have your private key and your hosts definition in your ssh config, you're still secure? Cool, send them to me and I'll show you otherwise. My email address is in my profile. The point was that nuance is important. Keyspace size, the cost and penalties of a guess, if any information leaks in the process, these are important. These cutesy memorable rhyming platitudes in any discipline are usually either meaningless or counterproductive. I could for instance, use a very long base64 url endpoint as effectively a shared password. If you look at the cost, leakage, and keyspace analysis you can tell why it works or it doesn't far more than the old obscurity aphorism. I think some of computer security theory could be taught via physical lockpicks pretty well so long as the students actually do the physical lockpicking act. I think the concepts translate well to the material reality especially if you have a large diversity of locks. It actually sounds like a pretty brilliant educational approach. Computer security through lockpicking. Requirements: introductory number theory, discrete mathematics, 2 or more programming classes
  - dang 6y ago
    Please don't post like this, i.e. just putting someone else down. It's not in the spirit of the site and doesn't add any information. If you know more, that's great, but in that case please share some of what you know, so we all can learn. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
rwesty 6y ago
And in this case you are putting the lock in a place that is not the doorknob, where an intruder will typically try to unlock the door.
- samdixon 6y ago
  Albeit a now invisible knob that must be searched for via a door scan. While I don’t personally switch my ssh port from default, I would imagine doing so would cut down on a ton of the noise from lowest common denominator ssh attempts.
  - wutwutwutwut 6y ago
    I have changed some default ports and seeing the number of connection attempts drop from <many> down to close to zero was just nice. There are just fewer connections opened, fewer logs to analyze and so on. In my view, fewer connection attempts means less data to analyze which in my view is a security and cost benefit.
  - shiftpgdn 6y ago
    My entire house nearly instantly becomes invisible to anyone doing a door scan. This is what an effective psad/fail2ban setup can do.
craftinator 6y ago
So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all? In my practice it gets rid of ~95% of probes from people trying to break into my system. Whether it just signals that I know what I'm doing, or demands resources that the attackers aren't willing to give, I don't know, but it definitely has a positive effect on the security of my system.
- DominoTree 6y ago
  He's saying that it doesn't make your SSH configuration or SSH itself any more secure.
- SassyGrapefruit 6y ago
  >So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all No I think if you read particularly the "Why all the hate..." paragraph you'll see I'm saying the opposite of that. There is nothing wrong with obscurity but in terms of security its the icing not the cake. By that I mean it will make a secure setup more secure, but its not enough on its own.
- enkid 6y ago
  Aren't most SSH probes trying to break weak passwords? If so, having a strong password is much much more important than the port SSH is on.
  - bostik 6y ago
    Really, you should not be using passwords at all. We have key-based authentication for a reason.
    - enkid 6y ago
      Totally agree.
  - worik 6y ago
    Walk and chew gum.
enkid 6y ago
The problem is when you only use security by obscurity. Just changing then port does not do enough to make your insecure application secure. For example, if you have a Windows 2000 server on the internet, it doesn't matter what port you change IIS to, it's going to get hacked. To use your analogy, if your lock is broken, or can be broken, it doesn't matter where you hide the key.
- machello13 6y ago
  > The problem is when you only use security by obscurity. He literally says this exact thing in his comment.
  - enkid 6y ago
    I'm agreeing with him.
danielrm26 6y ago
I think you're confused a bit here. The mechanism is known for a door lock. It's a lock with a key. What they don't have is the key. If you leave your door key, or RSA key, lying around where it's easy to find, well...that's a separate problem.
Zenbit_UX 6y ago
> Its only cast in a negative light when it's the ONLY thing you do or if you consider it sufficient in terms of security. Yes, that was the takeaway from the article.
garmaine 6y ago
What makes this even more ridiculous is by the most literal definition, most of modern cryptography is "security by obscurity." My TLS or SSH connection remains secure because my selected private key remains obscure and hard to find in a space of 2^128 possible keys. Only a handful of techniques (quantum key exchange, one-time pads) are not relying on obscurity for their security. Security through obscurity works perfectly well so long as you correctly quantify the size of the search space, the bits of information provided as hints, and the cost of searching--which basically describes what much of modern cryptography is about, at the primitive construction layer. By the same measure, a multi-million dollar cache in the American Rocky Mountains remained unfound for a decade despite there being a poem and short story filled with clues as to its location[1]. If I go totally off-grid for 6 months, and then come out of the wilderness saying that at some point during that wandering I cached my valuable possessions in a secret location, you're not going to find it. The admonition not to use security by obscurity is well-meaning but requires explanation. We shouldn't hide things in ad-hoc search spaces that haven't been adequately formalized. We should prefer mathematical puzzles which have well characterized properties. And generally that is good advice. But that doesn't mean we shouldn't also throw in whatever extra protections are convenient, even if they're ad-hoc or provide insufficient bits of security by themselves. [1] https://en.wikipedia.org/wiki/Fenn_treasure https://en.wikipedia.org/wiki/Fenn_treasure
rconti 6y ago
You're missing the point; the point is that it's only bad when it's used instead of (say) disabling SSH if it's not needed, or using the latest release, or using secure ciphers. Doing all of the above as well as changing your sshd port will only improve your posture.
tasssko 6y ago
Yes the attack surface before and after is the same ergo this is not security at all. The difference between 22 and 2222 is a nominal delay on a port scan. It would be far easier and more convenient to use a ip whitelist and a firewall to protect access to 22.

kristopolous 6y ago

The parent changed his message so this is no longer in direct response but it's probably still valuable: By that logic so are passwords and the key itself, You simply have an "obscured" notch configuration on the grooves of the key. My ssh private key is also just a very uncommon sequence of bytes! It's all encompassing. So either your interpretation needs works, keys and passwords are insecure, or obscurity is actually totally fine.

opless 6y ago
That's incredibly tenuous. Also I don't think you know much about asymmetric encryption or the SSH protocol either.
- deleted 6y ago
  [deleted]
- kristopolous 6y ago
  So if I have your private key and your hosts definition in your ssh config, you're still secure? Cool, send them to me and I'll show you otherwise. My email address is in my profile. The point was that nuance is important. Keyspace size, the cost and penalties of a guess, if any information leaks in the process, these are important. These cutesy memorable rhyming platitudes in any discipline are usually either meaningless or counterproductive. I could for instance, use a very long base64 url endpoint as effectively a shared password. If you look at the cost, leakage, and keyspace analysis you can tell why it works or it doesn't far more than the old obscurity aphorism. I think some of computer security theory could be taught via physical lockpicks pretty well so long as the students actually do the physical lockpicking act. I think the concepts translate well to the material reality especially if you have a large diversity of locks. It actually sounds like a pretty brilliant educational approach. Computer security through lockpicking. Requirements: introductory number theory, discrete mathematics, 2 or more programming classes
- dang 6y ago
  Please don't post like this, i.e. just putting someone else down. It's not in the spirit of the site and doesn't add any information. If you know more, that's great, but in that case please share some of what you know, so we all can learn. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

rwesty 6y ago

And in this case you are putting the lock in a place that is not the doorknob, where an intruder will typically try to unlock the door.

samdixon 6y ago
Albeit a now invisible knob that must be searched for via a door scan. While I don’t personally switch my ssh port from default, I would imagine doing so would cut down on a ton of the noise from lowest common denominator ssh attempts.
- wutwutwutwut 6y ago
  I have changed some default ports and seeing the number of connection attempts drop from <many> down to close to zero was just nice. There are just fewer connections opened, fewer logs to analyze and so on. In my view, fewer connection attempts means less data to analyze which in my view is a security and cost benefit.
- shiftpgdn 6y ago
  My entire house nearly instantly becomes invisible to anyone doing a door scan. This is what an effective psad/fail2ban setup can do.

craftinator 6y ago

So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all? In my practice it gets rid of ~95% of probes from people trying to break into my system. Whether it just signals that I know what I'm doing, or demands resources that the attackers aren't willing to give, I don't know, but it definitely has a positive effect on the security of my system.

DominoTree 6y ago
He's saying that it doesn't make your SSH configuration or SSH itself any more secure.
SassyGrapefruit 6y ago
>So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all No I think if you read particularly the "Why all the hate..." paragraph you'll see I'm saying the opposite of that. There is nothing wrong with obscurity but in terms of security its the icing not the cake. By that I mean it will make a secure setup more secure, but its not enough on its own.
enkid 6y ago
Aren't most SSH probes trying to break weak passwords? If so, having a strong password is much much more important than the port SSH is on.
- bostik 6y ago
  Really, you should not be using passwords at all. We have key-based authentication for a reason.
  - enkid 6y ago
    Totally agree.
- worik 6y ago
  Walk and chew gum.

enkid 6y ago

The problem is when you only use security by obscurity. Just changing then port does not do enough to make your insecure application secure. For example, if you have a Windows 2000 server on the internet, it doesn't matter what port you change IIS to, it's going to get hacked. To use your analogy, if your lock is broken, or can be broken, it doesn't matter where you hide the key.

machello13 6y ago
> The problem is when you only use security by obscurity. He literally says this exact thing in his comment.
- enkid 6y ago
  I'm agreeing with him.

danielrm26 6y ago

I think you're confused a bit here. The mechanism is known for a door lock. It's a lock with a key. What they don't have is the key. If you leave your door key, or RSA key, lying around where it's easy to find, well...that's a separate problem.

Zenbit_UX 6y ago

> Its only cast in a negative light when it's the ONLY thing you do or if you consider it sufficient in terms of security. Yes, that was the takeaway from the article.

garmaine 6y ago

What makes this even more ridiculous is by the most literal definition, most of modern cryptography is "security by obscurity." My TLS or SSH connection remains secure because my selected private key remains obscure and hard to find in a space of 2^128 possible keys. Only a handful of techniques (quantum key exchange, one-time pads) are not relying on obscurity for their security. Security through obscurity works perfectly well so long as you correctly quantify the size of the search space, the bits of information provided as hints, and the cost of searching--which basically describes what much of modern cryptography is about, at the primitive construction layer. By the same measure, a multi-million dollar cache in the American Rocky Mountains remained unfound for a decade despite there being a poem and short story filled with clues as to its location[1]. If I go totally off-grid for 6 months, and then come out of the wilderness saying that at some point during that wandering I cached my valuable possessions in a secret location, you're not going to find it. The admonition not to use security by obscurity is well-meaning but requires explanation. We shouldn't hide things in ad-hoc search spaces that haven't been adequately formalized. We should prefer mathematical puzzles which have well characterized properties. And generally that is good advice. But that doesn't mean we shouldn't also throw in whatever extra protections are convenient, even if they're ad-hoc or provide insufficient bits of security by themselves. [1] https://en.wikipedia.org/wiki/Fenn_treasure https://en.wikipedia.org/wiki/Fenn_treasure

rconti 6y ago

You're missing the point; the point is that it's only bad when it's used instead of (say) disabling SSH if it's not needed, or using the latest release, or using secure ciphers. Doing all of the above as well as changing your sshd port will only improve your posture.

tasssko 6y ago

Yes the attack surface before and after is the same ergo this is not security at all. The difference between 22 and 2222 is a nominal delay on a port scan. It would be far easier and more convenient to use a ip whitelist and a firewall to protect access to 22.