Security through making things harder in some unquantifiable way for an attacker to exploit[1] is usually a waste of time (IMO) because there is no way to measu

Security through making things harder in some unquantifiable way for an attacker to exploit[1] is usually a waste of time (IMO) because there is no way to measure or even estimate with any kind of accuracy how much value it adds versus the costs of implementing and maintaining it. Maybe it will deter attackers forever, because you'll get lucky and no one will ever care enough to put in the effort. Maybe someone becomes obsessed with the thing you're trying to protect, and just for fun figures out how to bypass all of your work in a week, and publishes the result to Full Disclosure. The author of the article cites a typical information security faux version of a real thing: calculating risk by multiplying impact by likelihood. Risk is a real field, with real data collected to make those estimations as accurate as possible. Insurance companies use complex actuarial tables, which is where the old saw about red cars having higher insurance premiums comes from. They really do collect massive volumes of data to make estimates of likelihood from. In my field (information security) people who talk about likelihood are generally just guessing, or trusting their knee to ache when the haxxors are about to pwn the Gibson. There is no data, just someone guessing and plugging the number into a formula so that the result has the appearance of objectivity and science. Implementing controls that "make things harder" is a variation on that same theme. If one wants a security control they can trust, they should pick the ones that have actual math behind them, like "using this random token[/key/whatever] means that an attacker would have to guess for literally one million years to make a successful request". [1] of which security through obscurity is a subset.