3 ms·
> That's the way life works. Just because security by obscurity is not a barrier you should lean on doesn't mean that it lacks value in combination with other
by cturner 18y ago
> That's the way life works.
Just because security by obscurity is not a barrier you should lean on doesn't mean that it lacks value in combination with other measures.
Script kiddies will struggle to isolate data from memory in order to get passwords, particularly if they can't get binaries on the machine and it has no compiler. On the other hand, they will have no trouble using a copy and paste ps usage.
And when I say script kiddies, I also mean the sort of 9-5 culture, corner-cutting production support teams that exist in some organisations and who might have accounts on shared hardware that your application runs on. Do you really want to make it easy for them to do favours for people on the business side who want passwords they shouldn't have?
> The bottom line is that if you want to do password
> storage in your web app that is secure against local
> users, you have vastly more work to do than just finding
> a CPAN library somewhere.
I strongly disagree.
- ajross 18y agoI think you mean you agree with me, no? Unless you're really arguing that simply using a CPAN library renders your application secure to all attackers? I think you're arguing against the converse of what I stated, not my actual point.
- nailer 18y ago> Just because security by obscurity is not a barrier you should lean on doesn't mean that it lacks value in combination with other measures. Damn straight. Check out the DNS spoofing defences - using random ports to issue requests on. There's a known limit to port numbers, and you could probably circumvent it with massive amounts of traffic, but using an unknown port number makes it hard enough that performing that kind of attack is significantly more difficult.