4 ms·
The "security by obscurity" one-liner is one of my favorite examples of the sort of black-and-white thinking that is harmful to software engineering. The truth
by n42 5y ago
The "security by obscurity" one-liner is one of my favorite examples of the sort of black-and-white thinking that is harmful to software engineering.
The truth is that playing defense is as much an exercise of technical design as it is economics.
Yes - if someone finds the SSH port, they have a window of opportunity, and you will be owned if you are not properly securing your server through the normal channels.
However, now they only have a small window of opportunity (say, 30 seconds). This does a few things:
- it takes time (money) to attack a target. without access to the OTP secret, randomly assigning ports dramatically increases the cost (time) of attacking you. throw in a tar pit and it's even worse. if you're not a high value target, the attacker moves on.
- now, any failed authentication attempt to your SSH server is a highly credible threat. repeat attempts are even more suspect - you are being targeted, and they probably have the OTP secret. effectively, you are able to resource your team more efficiently, because you can filter out noise.
security is not black and white. if you are a valuable enough target, someone will find a way in. defense in depth helps you manage your defense with limited resources.
- jopsen 5y ago> defense in depth helps you manage your defense with limited resources. Indeed, but might there not better/cheaper ways to secure SSH? Something that doesn't involve custom configuration that needs to be maintained.. like VPN to a jump-host... Or..? Configuring and maintaining custom hacks is not cheap.
- n42 5y agoagreed - I would not deploy this as is, but the idea is interesting and I could imagine the concept being given some UX love in a different application
- SrslyJosh 5y agoI like this analysis, but I'm having a hard time seeing the advantage over port-knocking, which could also be randomized using OTP and would never reveal the SSH server to a port scan. Zero window seems better than a 30 second window. Excellent points otherwise.
- walrus01 5y ago> The "security by obscurity" one-liner is one of my favorite examples of the sort of black-and-white thinking that is harmful to software engineering. My primary problem with people going for "security through obscurity" is that very often there are things which are intentionally obfuscated or obscured, in such a way that the implementer thinks that their method of hiding things will provide a significant measure of security. But then all of the other more common sense security precautions that should be implemented before the obscurity are ignored. If I had a dollar for every industrial/embedded/M2M/IOT type thing that tries to be secure through obscurity but has other gaping holes in it, once you're familiar with the technical workings of the product...