3 ms·
>This distinction between informational asymmetry and security through obscurity seems artificial. Doesn't security through obscurity rely on informational asym
by jasode 4y ago
>This distinction between informational asymmetry and security through obscurity seems artificial. Doesn't security through obscurity rely on informational asymmetry by definition?
It depends on your definition:
- (1) "security through obscurity" is an unbiased term with no negative connotations which simply describes a situation without judgement. Parsing that phrase in this purely logical way means "information asymmetry" is a distinction without a difference. This neutral meaning is what your comment is highlighting.
... or ...
- (2) "security through obscurity" is a negative cultural meme and the recipients of that phrase are people who are incompetent in understanding security concepts. E.g. they don't realize that it's a flaw to hide the password key in a config file in a undocumented folder and hope the hackers don't find it. It's this STO-the-negative-meme that the blog post is trying to distance itself from by emphasizing a alternative phrase "informational asymmetry". Keeping the exact moderation rules a "secret" is IA-we-know-what-we're-doing -- instead of -- STO-we're-idiots.
The blog author differentiating from (2) because that's the meaning Cory Doctorow used in sentences such as "In information security practice, “security through obscurity” is considered a fool’s errand." : https://www.eff.org/deeplinks/2022/05/tracking-exposed-demanding-gods-explain-themselves https://www.eff.org/deeplinks/2022/05/tracking-exposed-deman...
- Gordonjcp 4y agoI and I suspect many like me realise that the truth lies somewhere in the middle. Do I use security-by-obscurity? Of course! I know that my server is going to get hammered with attempts to steal info, and I can see /path/to/webroot/.git/config getting requested several times an hour, so I don't put important stuff in places where it might be accessed. Even giving it a silly name won't help, it has to be simply not something that's there at all. That kind of security-by-obscurity is asking for trouble. Sure as hell though, if I move ssh off of port 22 then the number of folk trying to guess passwords drops to *zero*, instantly.
- creeble 4y ago>Sure as hell though, if I move ssh off of port 22 then the number of folk trying to guess passwords drops to zero, instantly. But not for very long. But it doesn't matter, but for log annoyances.
- bombcar 4y agoI’ve found dictionary attacks against non-22 ssh to be effectively zero. Maybe once in awhile you get a port scan and a poke or two, but anyone able to move ssh off of 22 is not likely to have the password “p4ssw0rd”
- Gordonjcp 4y agoIt's a bit like the bit with the fake tan in Neuromancer. "You think that looks real?" "Nah, but it looks like you care enough to fake it." If you care enough to move your ssh port you're probably not totally clueless at best, and at worst you're setting out bait.