4 ms·

> security by obscurity I’ve often wondered at a more abstract level, where’s the line? A password or a private key are security by obscurity.

shahbaby 4y ago
All security relies on some sort of secret. When brute force guessing of that secret in the best case gives a motivated attacker or a random person a chance of stumbling upon it, that's a failure of security by obscurity. With passwords and private keys we can mathematically verify that brute force attacks won't work. At that point we're not relying on obscurity because we're assuming the attacker has knoweldege of everything except the secret itself.
- m3047 4y ago
  A castle on the hill is hard to hide but also hard to approach, and requires hauling breaching tools and weaponry uphill.
DiffEq 4y ago
Security through obscurity is a great idea and works to slow down, prevent and even stop and attack from going forward for all kinds of systems whether is be an animal and their camouflage or a computer system holding PII with a vacuous name. Where the utility breaks down is when that is your ONLY means or layer of security. For example my house is hard to see from the road…so an opportunist thief might never see it and so just pass on by. But say this criminal finds my house by some fortuitous means. Well now he has to get past my locks and then the and if I am home, the bullets that may fly his way. And then he will have to try and get away before the police arrive.
remram 4y ago
> A password or a private key are security by obscurity. No, they're not. You could think that if you're trying to guess what the term means, but it means something specific that is the opposite of basing your security on a specific secret that is decoupled from all implementation concerns. >> Security by obscurity is the reliance on design or implementation secrecy as the main method of providing security to a system or component.
- user3939382 4y ago
  It's not that black and white. Port knocking for instance, is basically extending the password. Is the port configuration "implementation"?
  - remram 4y ago
    You mean "it's not always black and white" and you are right. However the grandparent's case is clear-cut.
    - user3939382 4y ago
      They said “it means” i.e. defining a rule. The point of my original comment is that the boundaries are fuzzy, so I wasn’t commenting on specific examples but the concept of the rule.
- Retric 4y ago
  Yes and no, passwords are an implementation detail. There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords.
  - cmeacham98 4y ago
    > Yes and no, passwords are an implementation detail. Passwords are not an "implementation detail" unless they are hardcoded (and a hardcoded password is very arguably security by obscurity). > There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords. Yes, because the bank card provides some additional form of authentication, typically in the form of a chip on the card.
    - Retric 4y ago
      Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic. You need a carefully constructed system to make the use of passwords viable.
Spooky23 4y ago
In online fora, “security by obscurity” is when you disagree with someone. In reality, it’s when the primary control used is restricted, shared knowledge. Famously back in the day if you knew a phone number and AT&T lingo, you could compromise the phone system. In the case of a public CA, if your hostnames aren’t license plates, the names of servers may provide context useful for an attacker. They also provide an attack vector - the control panel for the CA.

shahbaby 4y ago

All security relies on some sort of secret. When brute force guessing of that secret in the best case gives a motivated attacker or a random person a chance of stumbling upon it, that's a failure of security by obscurity. With passwords and private keys we can mathematically verify that brute force attacks won't work. At that point we're not relying on obscurity because we're assuming the attacker has knoweldege of everything except the secret itself.

m3047 4y ago
A castle on the hill is hard to hide but also hard to approach, and requires hauling breaching tools and weaponry uphill.

DiffEq 4y ago

Security through obscurity is a great idea and works to slow down, prevent and even stop and attack from going forward for all kinds of systems whether is be an animal and their camouflage or a computer system holding PII with a vacuous name. Where the utility breaks down is when that is your ONLY means or layer of security. For example my house is hard to see from the road…so an opportunist thief might never see it and so just pass on by. But say this criminal finds my house by some fortuitous means. Well now he has to get past my locks and then the and if I am home, the bullets that may fly his way. And then he will have to try and get away before the police arrive.

remram 4y ago

> A password or a private key are security by obscurity. No, they're not. You could think that if you're trying to guess what the term means, but it means something specific that is the opposite of basing your security on a specific secret that is decoupled from all implementation concerns. >> Security by obscurity is the reliance on design or implementation secrecy as the main method of providing security to a system or component.

user3939382 4y ago
It's not that black and white. Port knocking for instance, is basically extending the password. Is the port configuration "implementation"?
- remram 4y ago
  You mean "it's not always black and white" and you are right. However the grandparent's case is clear-cut.
  - user3939382 4y ago
    They said “it means” i.e. defining a rule. The point of my original comment is that the boundaries are fuzzy, so I wasn’t commenting on specific examples but the concept of the rule.
Retric 4y ago
Yes and no, passwords are an implementation detail. There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords.
- cmeacham98 4y ago
  > Yes and no, passwords are an implementation detail. Passwords are not an "implementation detail" unless they are hardcoded (and a hardcoded password is very arguably security by obscurity). > There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords. Yes, because the bank card provides some additional form of authentication, typically in the form of a chip on the card.
  - Retric 4y ago
    Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic. You need a carefully constructed system to make the use of passwords viable.

Spooky23 4y ago

In online fora, “security by obscurity” is when you disagree with someone. In reality, it’s when the primary control used is restricted, shared knowledge. Famously back in the day if you knew a phone number and AT&T lingo, you could compromise the phone system. In the case of a public CA, if your hostnames aren’t license plates, the names of servers may provide context useful for an attacker. They also provide an attack vector - the control panel for the CA.