I think that "Security by obscurity is bad" is really a misstatement. The right version should be "Open design is better". The underlying assumption is that cr

I think that "Security by obscurity is bad" is really a misstatement. The right version should be "Open design is better". The underlying assumption is that criminals are often smarter (or having more advantage) than defenders. But they probably do not outsmart the entire human intelligence, so there's a hope that an open design that actually survived can better protect us in a long run (because they're viewed and attacked by everyone). i.e. Individuals < Criminals < Collective Intelligence In this case, I don't think using an unusual SSH port is security by obscurity. Its design is already open; knowing the port number doesn't significantly change the threat model because SSH itself already provides a certain level of security.