All security relies on some sort of secret. When brute force guessing of that secret in the best case gives a motivated attacker or a random person a chance of

All security relies on some sort of secret. When brute force guessing of that secret in the best case gives a motivated attacker or a random person a chance of stumbling upon it, that's a failure of security by obscurity. With passwords and private keys we can mathematically verify that brute force attacks won't work. At that point we're not relying on obscurity because we're assuming the attacker has knoweldege of everything except the secret itself.