4 ms·

The term "security by obscurity" or "security through obscurity" implies that ONLY obscurity is being used to provide the security in question. Like leaving a t

The term "security by obscurity" or "security through obscurity" implies that ONLY obscurity is being used to provide the security in question. Like leaving a totally unsecured server on your network with root access available with no password, and telnet or sshd open on a high numbered port instead of the regular ones. Obscurity is a useful tool to be added on top of real security, and can help reduce the random baseline doorknob jiggling attacks, where people are just scanning the standard ports. But obscurity by itself is not enough to provide any real security beyond that.

bruce511 3y ago
You are completely correct. For a level 3 person. Level 1 : I don't know what I'm doing, so I'll invent stuff only I know in the expectation that'll be enough. This person is told (with good reason) that security by obscurity is no security at all. Level 2. They got the above message, so do everything right. Setups, firewalls, permissions, and so on. They are proud of their expertise and lecture level 1s all day long. Level 3. Understand that all the fundamentals need to be done right. Add addional obscurity onto that because it doesn't hurt, and can filter out some useless traffic. (These folk should also lecture level 1 with the simplified message, but can explain the benefits to level 2.) The problem with HN threads like these is that I don't know who's giving the advice. Level 1 2 or 3. Equally readers could be any level. Which might be dangerous if they are level 1. IF you ARE level 1, learn the correct way to secure things first. THEN feel free to add obscurity onto that if you like.
- hnfong 3y ago
  I dunno, it feels to me that people are too ready to tell "white half-truths" to simplify the message, and assume everyone else is too dense to understand nuance... Why can't we just outright say to everyone: "learn the correct way to secure things first. THEN feel free to add obscurity onto that if you like"? There's probably some way to convert that message into a catchy phrase, instead of just demonizing security by obscurity, yet having a small sect of elites in the know who break their own "rules"... FWIW, this (rant) applies to a broader scope as well, beyond "security by obscurity".
  - bruce511 3y ago
    When educating anyone about anything we tell half-truths all the time. It's a necessary path to understanding. (For example, we teach kids the earth is round, then we tell them it's an oblate spheroid, then we tell them even that is a approximation. ) In a forum like this, the message is often distilled because one doesn't know the makeup of the audience. The simple rule is a good starting point for entry-levels. Nuance can be hard to convey, because its usually a combination of context and resources which determine how far down a rabbit hole you can go. I agree that this happens all the time, in every field. I'm dumb when it comes to my car, so my mechanic gives me simple rules to follow. Doctors tell everyone to eat less, exercise more, but in truth you can eat too little, and exercise too much. The -real- problem happens even a simplification becomes obsolete. We see this in security a lot. Someone wrote the company policies 20 years ago, and they're insisting on say no-paste-on-the-password field, because that's in the policy, even though its since been shown to weaken security.
illiac786 3y ago
Yeah but why is it a saying and "security by anything-else is not good" isn't a saying. What layer of security is sufficient on its own? None. Why is "obscurity" being singled out? It always feels a little condescendant, like "oh I got a cool saying that applies to most noobs in security, let's use it", implying one is assuming the other party in the conversation knows less.
- bradknowles 3y ago
  How would you apply this "anything else"? What "anything else" did you have in mind? If you can come up with some good examples, maybe we can make that a thing. Until then, we know that "Security by obscurity" is really bad, if that's the only thing you're relying on for security. Otherwise, that would be "Security by something else plus obscurity", which might or might not be a bad thing, depending on what the "something else" happens to be.
  - illiac786 3y ago
    Access lists alone are not sufficient Authentication alone is not sufficient IDS alone is not sufficient Encryption in transit alone is not sufficient Etc.

bruce511 3y ago

You are completely correct. For a level 3 person. Level 1 : I don't know what I'm doing, so I'll invent stuff only I know in the expectation that'll be enough. This person is told (with good reason) that security by obscurity is no security at all. Level 2. They got the above message, so do everything right. Setups, firewalls, permissions, and so on. They are proud of their expertise and lecture level 1s all day long. Level 3. Understand that all the fundamentals need to be done right. Add addional obscurity onto that because it doesn't hurt, and can filter out some useless traffic. (These folk should also lecture level 1 with the simplified message, but can explain the benefits to level 2.) The problem with HN threads like these is that I don't know who's giving the advice. Level 1 2 or 3. Equally readers could be any level. Which might be dangerous if they are level 1. IF you ARE level 1, learn the correct way to secure things first. THEN feel free to add obscurity onto that if you like.

hnfong 3y ago
I dunno, it feels to me that people are too ready to tell "white half-truths" to simplify the message, and assume everyone else is too dense to understand nuance... Why can't we just outright say to everyone: "learn the correct way to secure things first. THEN feel free to add obscurity onto that if you like"? There's probably some way to convert that message into a catchy phrase, instead of just demonizing security by obscurity, yet having a small sect of elites in the know who break their own "rules"... FWIW, this (rant) applies to a broader scope as well, beyond "security by obscurity".
- bruce511 3y ago
  When educating anyone about anything we tell half-truths all the time. It's a necessary path to understanding. (For example, we teach kids the earth is round, then we tell them it's an oblate spheroid, then we tell them even that is a approximation. ) In a forum like this, the message is often distilled because one doesn't know the makeup of the audience. The simple rule is a good starting point for entry-levels. Nuance can be hard to convey, because its usually a combination of context and resources which determine how far down a rabbit hole you can go. I agree that this happens all the time, in every field. I'm dumb when it comes to my car, so my mechanic gives me simple rules to follow. Doctors tell everyone to eat less, exercise more, but in truth you can eat too little, and exercise too much. The -real- problem happens even a simplification becomes obsolete. We see this in security a lot. Someone wrote the company policies 20 years ago, and they're insisting on say no-paste-on-the-password field, because that's in the policy, even though its since been shown to weaken security.

illiac786 3y ago

Yeah but why is it a saying and "security by anything-else is not good" isn't a saying. What layer of security is sufficient on its own? None. Why is "obscurity" being singled out? It always feels a little condescendant, like "oh I got a cool saying that applies to most noobs in security, let's use it", implying one is assuming the other party in the conversation knows less.

bradknowles 3y ago
How would you apply this "anything else"? What "anything else" did you have in mind? If you can come up with some good examples, maybe we can make that a thing. Until then, we know that "Security by obscurity" is really bad, if that's the only thing you're relying on for security. Otherwise, that would be "Security by something else plus obscurity", which might or might not be a bad thing, depending on what the "something else" happens to be.
- illiac786 3y ago
  Access lists alone are not sufficient Authentication alone is not sufficient IDS alone is not sufficient Encryption in transit alone is not sufficient Etc.