3 ms·
>It’s a design fallacy that security through obscurity is good. Yet, still obscurity increases security. Reverse engineering is not trivial and raises the bar
by tester756 3y ago
>It’s a design fallacy that security through obscurity is good.
Yet, still obscurity increases security.
Reverse engineering is not trivial and raises the bar.
- prepend 3y ago> Yet, still obscurity increases security. I disagree and think obscurity decreases security. It just gives the false belief of security.
- tester756 3y agoReverse engineering is not trivial and raises the bar.
- fsflover 3y agoAny relevant links? I can share this: https://blog.invisiblethings.org/2008/09/02/three-approaches-to-computer-security.html https://blog.invisiblethings.org/2008/09/02/three-approaches...
- tester756 3y agoWhat would I need link for? The point is simple - obscurity as an addition increases security. Reverse engineering is not trivial and raises the bar. Edit. Oh, your link supports that >The obvious disadvantage of this approach is that it doesn't prevent the bugs from being exploited - it only make the meaningful exploitation very hard or even impossible. But if one is concerned also about e.g. DoS attacks, then Security by Obscurity will not prevent them in most cases. The other problem with obfuscating the code is the performance (compiler cannot optimize the code for speed) and maintenance (if we got a crash dump on an "obfuscated" Windows box, we couldn't count on help from the technical support). Finally there is a problem of proving that the whole scheme is correct and that our obfuscator (or e.g. ASLR engine) doesn't introduce bugs to the generated code and that we will not get random crashes later (that we would be most likely unable to debug, as the code will be obfuscated).