The problem is when you only use security by obscurity. Just changing then port does not do enough to make your insecure application secure. For example, if y

The problem is when you only use security by obscurity. Just changing then port does not do enough to make your insecure application secure. For example, if you have a Windows 2000 server on the internet, it doesn't matter what port you change IIS to, it's going to get hacked. To use your analogy, if your lock is broken, or can be broken, it doesn't matter where you hide the key.