2 ms·

>Your threat model is not super hackers with unlimited resources, obscurity helps, in some cases it helps a LOT. You don’t know who is going to try to hack the

>Your threat model is not super hackers with unlimited resources, obscurity helps, in some cases it helps a LOT. You don’t know who is going to try to hack the system, and the security strategy should handle the fact that the system is going to be compromised at some point. Otherwise you don’t have a security policy, but simply a more or less efficient palliative to fear that risks generates. Yes, if you know who is going to have a will to attack, in which timeframe and with which resources at hand, security by obscurity surely can help a lot. Otherwise this is just buying the comfort of delusion, in my humble opinion.

thot_experiment 4y ago
> Otherwise this is just buying the comfort of delusion The same goes for any other security "guarantee". Security isn't something you rely on, it's a constant fight, obscurity is a reasonable thing to have in your arsenal. If you're at some point claiming "this is secure" you're deluding yourself, the only reasonable claim is "we have a lot of barriers to being compromised" or perhaps "we are secure against this vector", if obscurity is one of those barriers that's real and it provides a tangible benefit. Penetration is stochastic, the measures you take to prevent it change the odds.
UncleMeat 4y ago
Kerckhoff's Principle only applies to cryptosystems. In systems security it is more like an onion or layers of swiss cheese.