4 ms·

This distinction between informational asymmetry and security through obscurity seems artificial. Doesn't security through obscurity rely on informational asymm

This distinction between informational asymmetry and security through obscurity seems artificial. Doesn't security through obscurity rely on informational asymmetry by definition? What is the distinction here? It would be more honest to say that security through obscurity sometimes works, and sometimes doesn't have an alternative. And bot prevention is such a case. I'm not aware of any open source bot prevention system that works against determined attackers. Any real world security system relies to some extent on security through obscurity. No museum is going to publish their security system. It's only in the digital world that certain things, such as encryption, can be secure even under conditions where an adversary understands the entire system, so that security through obscurity in that context is frowned upon because it shouldn't be necessary. But this is a special case. Security is mostly a red queens race, and "obscurity" or "informational asymmetry" is an advantage the defenders have.

3pt14159 4y ago
> I'm not aware of any open source bot prevention system that works against determined attackers. It works just fine if you're willing to move to an invite only system and ban not just the bot, but the person that invited them. Possibly even another level up. The problem with this system is that it leads to much less inflated numbers about active users, etc. So very few companies do it.
- carbotaniuman 4y ago
  Such a system is still vulnerable (I'd daresay even more so) to account takeovers. And it might even have cascading effects depending on how your ban one level up goes. For a first approximation, even if one user can only invite 2 users, exponential growth will mean that bots may still pose a problem.
  - 3pt14159 4y ago
    > vulnerable (I'd daresay even more so) to account takeovers. Not more so. Vulnerability is a function of defensive capacity. There is no reduced defensive capacity. If anything, knowing who invited whom can allow one to allow web-of-trust based checks on suspicious login, allowing for more stringent guards. > For a first approximation, even if one user can only invite 2 users, exponential growth will mean that bots may still pose a problem. In these types of systems users earn invites over time and as a function of positive engagement with other trusted members. Exponential growth is neutered in such systems because the lag for bad actors and the natural pruning of the tree for bots and other abusive accounts, leads to a large majority of high quality trusted accounts. This means that content flagging is much more reliable. So, yes, bots are still a (minor) problem, but the system as a whole is much more robust and unless there is severe economic incentive to do so, most bot operators understand that the lower hanging fruit is elsewhere.
    - pixl97 4y ago
      You misunderstand some of the vulnerabilities then. Bad actors on the systems are not the only weaknesses of the system. Other systems are potential weaknesses of your system.... But what do I mean by that? If other systems have better ease of use while blocking 'enough' bad actors it is likely your exceptionally defensive system will fail. "I got blocked from SYSTEM1 for no reason, hey everyone, lets go to SYSTEM2", this is risky if one of the blocked people is high visibility, and these kinds of accounts tend lead the operator to make special hidden rules that tend to fall under security by obscurity of the rules.
      - 3pt14159 4y ago
        Let's discuss language first then. I do not think every weakness is a vulnerability. Were it so, then all things are vulnerabilities to some agent or entity in some sense, since weakness is often defined in relative terms. If another system is easier to use for say, signup. Then of course the system I propose will have to leverage its strengths to make up for the fact that it is harder to join. But there are plenty of nightclubs and restaurants that one can just simply not get into unless they know someone. They're often the most acclaimed. If the system I propose leads to a celebrity's ouster then the mechanisms and business orientation of the system would need to leverage that ouster to its benefit after, of course, making sure that the system as designed only ousts truly irritable people. One may say, "but if a given celebrity attracts many people and their ouster would lead many of them off of the platform how can this be used to our benefit?" But it is precisely this dynamic that the system that I advocate for has as its chief strength! Those that would leave merely at the call of a scorned leader despite having a more fruitful and productive conversation on the platform are those that are most probably least likely to positively engage with the platform in the first place.
        pixl97 4y ago
        Um, so you're reinventing the private club... quite an original idea.... But not really a useful one in any sense. You don't need any special technology to implement this idea. Just have a membership board that votes in/out members if it's such an exclusive group. This in itself is rather solved problem, but not a useful problem worth discussing when addressing issues on a larger scale.
- Gigachad 4y ago
  It's way too much friction. It's why we are commenting here, on this open site, instead of lobste.rs As an absolute last resort, yes, invite only does work. But people will only seek out invites if there is something extremely desirable to be found on the site like a private torrent tracker.
nonrandomstring 4y ago
The concept that both Alec and Cory are dancing around but do not name directly is basically Kerckhoffs's principle [1]. They're both right: Alec in saying that open detailed knowledge of moderation algorithms would harm the mission, and Cory for saying that a protocol/value level description of moderation gives insufficient assurance. That's because abuse detection isn't cryptography in which the mechanism can be neatly separated from a key. [1] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
marcosdumay 4y ago
> This distinction between informational asymmetry and security through obscurity seems artificial. It is. What is meaningful is how much entropy you are hiding from your wanna-be attackers and what costs you pay for it. Experts call it "security through obscurity" when the information content is low and the price is high.
- alecmuffett 4y ago
  nicely put.
jasode 4y ago
>This distinction between informational asymmetry and security through obscurity seems artificial. Doesn't security through obscurity rely on informational asymmetry by definition? It depends on your definition: - (1) "security through obscurity" is an unbiased term with no negative connotations which simply describes a situation without judgement. Parsing that phrase in this purely logical way means "information asymmetry" is a distinction without a difference. This neutral meaning is what your comment is highlighting. ... or ... - (2) "security through obscurity" is a negative cultural meme and the recipients of that phrase are people who are incompetent in understanding security concepts. E.g. they don't realize that it's a flaw to hide the password key in a config file in a undocumented folder and hope the hackers don't find it. It's this STO-the-negative-meme that the blog post is trying to distance itself from by emphasizing a alternative phrase "informational asymmetry". Keeping the exact moderation rules a "secret" is IA-we-know-what-we're-doing -- instead of -- STO-we're-idiots. The blog author differentiating from (2) because that's the meaning Cory Doctorow used in sentences such as "In information security practice, “security through obscurity” is considered a fool’s errand." : https://www.eff.org/deeplinks/2022/05/tracking-exposed-demanding-gods-explain-themselves https://www.eff.org/deeplinks/2022/05/tracking-exposed-deman...
- Gordonjcp 4y ago
  I and I suspect many like me realise that the truth lies somewhere in the middle. Do I use security-by-obscurity? Of course! I know that my server is going to get hammered with attempts to steal info, and I can see /path/to/webroot/.git/config getting requested several times an hour, so I don't put important stuff in places where it might be accessed. Even giving it a silly name won't help, it has to be simply not something that's there at all. That kind of security-by-obscurity is asking for trouble. Sure as hell though, if I move ssh off of port 22 then the number of folk trying to guess passwords drops to *zero*, instantly.
  - creeble 4y ago
    >Sure as hell though, if I move ssh off of port 22 then the number of folk trying to guess passwords drops to zero, instantly. But not for very long. But it doesn't matter, but for log annoyances.
benj111 4y ago
Well yes. But in that case a password is security through obscurity. I struggle to think of any security scheme that doesn't rely on knowing something the attacker doesn't. So unless you want to write everything off as STO you need to introduce some nuance into the conversation. IA seems to me to be a useful nuance.
- alecmuffett 4y ago
  That's my point, yes.

3pt14159 4y ago

> I'm not aware of any open source bot prevention system that works against determined attackers. It works just fine if you're willing to move to an invite only system and ban not just the bot, but the person that invited them. Possibly even another level up. The problem with this system is that it leads to much less inflated numbers about active users, etc. So very few companies do it.

carbotaniuman 4y ago
Such a system is still vulnerable (I'd daresay even more so) to account takeovers. And it might even have cascading effects depending on how your ban one level up goes. For a first approximation, even if one user can only invite 2 users, exponential growth will mean that bots may still pose a problem.
- 3pt14159 4y ago
  > vulnerable (I'd daresay even more so) to account takeovers. Not more so. Vulnerability is a function of defensive capacity. There is no reduced defensive capacity. If anything, knowing who invited whom can allow one to allow web-of-trust based checks on suspicious login, allowing for more stringent guards. > For a first approximation, even if one user can only invite 2 users, exponential growth will mean that bots may still pose a problem. In these types of systems users earn invites over time and as a function of positive engagement with other trusted members. Exponential growth is neutered in such systems because the lag for bad actors and the natural pruning of the tree for bots and other abusive accounts, leads to a large majority of high quality trusted accounts. This means that content flagging is much more reliable. So, yes, bots are still a (minor) problem, but the system as a whole is much more robust and unless there is severe economic incentive to do so, most bot operators understand that the lower hanging fruit is elsewhere.
  - pixl97 4y ago
    You misunderstand some of the vulnerabilities then. Bad actors on the systems are not the only weaknesses of the system. Other systems are potential weaknesses of your system.... But what do I mean by that? If other systems have better ease of use while blocking 'enough' bad actors it is likely your exceptionally defensive system will fail. "I got blocked from SYSTEM1 for no reason, hey everyone, lets go to SYSTEM2", this is risky if one of the blocked people is high visibility, and these kinds of accounts tend lead the operator to make special hidden rules that tend to fall under security by obscurity of the rules.
    - 3pt14159 4y ago
      Let's discuss language first then. I do not think every weakness is a vulnerability. Were it so, then all things are vulnerabilities to some agent or entity in some sense, since weakness is often defined in relative terms. If another system is easier to use for say, signup. Then of course the system I propose will have to leverage its strengths to make up for the fact that it is harder to join. But there are plenty of nightclubs and restaurants that one can just simply not get into unless they know someone. They're often the most acclaimed. If the system I propose leads to a celebrity's ouster then the mechanisms and business orientation of the system would need to leverage that ouster to its benefit after, of course, making sure that the system as designed only ousts truly irritable people. One may say, "but if a given celebrity attracts many people and their ouster would lead many of them off of the platform how can this be used to our benefit?" But it is precisely this dynamic that the system that I advocate for has as its chief strength! Those that would leave merely at the call of a scorned leader despite having a more fruitful and productive conversation on the platform are those that are most probably least likely to positively engage with the platform in the first place.
      - pixl97 4y ago
        Um, so you're reinventing the private club... quite an original idea.... But not really a useful one in any sense. You don't need any special technology to implement this idea. Just have a membership board that votes in/out members if it's such an exclusive group. This in itself is rather solved problem, but not a useful problem worth discussing when addressing issues on a larger scale.
Gigachad 4y ago
It's way too much friction. It's why we are commenting here, on this open site, instead of lobste.rs As an absolute last resort, yes, invite only does work. But people will only seek out invites if there is something extremely desirable to be found on the site like a private torrent tracker.

nonrandomstring 4y ago

The concept that both Alec and Cory are dancing around but do not name directly is basically Kerckhoffs's principle [1]. They're both right: Alec in saying that open detailed knowledge of moderation algorithms would harm the mission, and Cory for saying that a protocol/value level description of moderation gives insufficient assurance. That's because abuse detection isn't cryptography in which the mechanism can be neatly separated from a key. [1] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

marcosdumay 4y ago

> This distinction between informational asymmetry and security through obscurity seems artificial. It is. What is meaningful is how much entropy you are hiding from your wanna-be attackers and what costs you pay for it. Experts call it "security through obscurity" when the information content is low and the price is high.

alecmuffett 4y ago
nicely put.

jasode 4y ago

>This distinction between informational asymmetry and security through obscurity seems artificial. Doesn't security through obscurity rely on informational asymmetry by definition? It depends on your definition: - (1) "security through obscurity" is an unbiased term with no negative connotations which simply describes a situation without judgement. Parsing that phrase in this purely logical way means "information asymmetry" is a distinction without a difference. This neutral meaning is what your comment is highlighting. ... or ... - (2) "security through obscurity" is a negative cultural meme and the recipients of that phrase are people who are incompetent in understanding security concepts. E.g. they don't realize that it's a flaw to hide the password key in a config file in a undocumented folder and hope the hackers don't find it. It's this STO-the-negative-meme that the blog post is trying to distance itself from by emphasizing a alternative phrase "informational asymmetry". Keeping the exact moderation rules a "secret" is IA-we-know-what-we're-doing -- instead of -- STO-we're-idiots. The blog author differentiating from (2) because that's the meaning Cory Doctorow used in sentences such as "In information security practice, “security through obscurity” is considered a fool’s errand." : https://www.eff.org/deeplinks/2022/05/tracking-exposed-demanding-gods-explain-themselves https://www.eff.org/deeplinks/2022/05/tracking-exposed-deman...

Gordonjcp 4y ago
I and I suspect many like me realise that the truth lies somewhere in the middle. Do I use security-by-obscurity? Of course! I know that my server is going to get hammered with attempts to steal info, and I can see /path/to/webroot/.git/config getting requested several times an hour, so I don't put important stuff in places where it might be accessed. Even giving it a silly name won't help, it has to be simply not something that's there at all. That kind of security-by-obscurity is asking for trouble. Sure as hell though, if I move ssh off of port 22 then the number of folk trying to guess passwords drops to *zero*, instantly.
- creeble 4y ago
  >Sure as hell though, if I move ssh off of port 22 then the number of folk trying to guess passwords drops to zero, instantly. But not for very long. But it doesn't matter, but for log annoyances.

benj111 4y ago

Well yes. But in that case a password is security through obscurity. I struggle to think of any security scheme that doesn't rely on knowing something the attacker doesn't. So unless you want to write everything off as STO you need to introduce some nuance into the conversation. IA seems to me to be a useful nuance.

alecmuffett 4y ago
That's my point, yes.