3 ms·

"We've implemented many different security measures, but talking about them on camera would be insecure" (Paraphrased) Yes, because security by obscurity has s

"We've implemented many different security measures, but talking about them on camera would be insecure" (Paraphrased) Yes, because security by obscurity has such an awesome track record. In fact, if whoever is responsible for this fiasco had asked on Stack Exchange how he best store passwords, this whole hoopla could've been avoided.

Yrlec 14y ago
To be fair though, all security is about obscurity. The questions is just how obscure. One could certainly argue that using bcrypt instead of SHA-1 without salting is a lot more important than not disclosing your security practices but they are not mutually exclusive.
- dag11 14y ago
  TLS is secure, right? TLS is by no means obscure. Good security does not need to be obscure. If it does, that means that it can be defeated if its methods are known, which doesn't sound like very good security to me.
  - Negitivefrags 14y ago
    All security is about obscurity because it involves having a secret that you don't believe anyone else can get. (ie; a password, a private key, cert, a random number, a physical object).
    - jacobwil 14y ago
      That isn't what security through obscurity ever means though. You're taking the words at face value while everyone else is using the words for what they actually mean. Security by obscurity doesn't refer to the secrets used as keys but instead to the way those keys are stored used to perform authentication.
larrys 14y ago
"because security by obscurity has such an awesome track record." Please elaborate on how you feel that security for linkedin would be better if they talked about the new specific security measures they've implemented.
- IvoDankolov 14y ago
  Good security is safe in spite of knowing exactly how it works. While revealing the exact details does not make an algorithm less vulnerable, it should not make it more so. And if it turns out that you are using a flawed solution, talking about it early will, at the very least, get people to yell at you as to what you should do instead. In this age, the best security algorithms are usually the one most talked about. The more you test it and the more people you get to look at it and write theorems and papers about size of the search space, results from various attacks and so forth, the better.
- deleted 14y ago
  [deleted]
- mcantelon 14y ago
  Peer review.
- jlarocco 14y ago
  If they had talked about storing unsalted passwords in the first place, this whole thing may not have happened because somebody would have told them, "Hey, that's dumb" before the leak.
  - larrys 14y ago
    We're talking about a major corporation here. They can pay for and hire the appropriate security experts (even more than one firm) and find something like that out.
    - jlarocco 14y ago
      If they weren't competent enough to do that before, what makes you think they're competent enough to do it now? For all we know, they've "fixed" the issue by switching to unsalted MD5 password hashes.

Yrlec 14y ago

To be fair though, all security is about obscurity. The questions is just how obscure. One could certainly argue that using bcrypt instead of SHA-1 without salting is a lot more important than not disclosing your security practices but they are not mutually exclusive.

dag11 14y ago
TLS is secure, right? TLS is by no means obscure. Good security does not need to be obscure. If it does, that means that it can be defeated if its methods are known, which doesn't sound like very good security to me.
- Negitivefrags 14y ago
  All security is about obscurity because it involves having a secret that you don't believe anyone else can get. (ie; a password, a private key, cert, a random number, a physical object).
  - jacobwil 14y ago
    That isn't what security through obscurity ever means though. You're taking the words at face value while everyone else is using the words for what they actually mean. Security by obscurity doesn't refer to the secrets used as keys but instead to the way those keys are stored used to perform authentication.

larrys 14y ago

"because security by obscurity has such an awesome track record." Please elaborate on how you feel that security for linkedin would be better if they talked about the new specific security measures they've implemented.

IvoDankolov 14y ago
Good security is safe in spite of knowing exactly how it works. While revealing the exact details does not make an algorithm less vulnerable, it should not make it more so. And if it turns out that you are using a flawed solution, talking about it early will, at the very least, get people to yell at you as to what you should do instead. In this age, the best security algorithms are usually the one most talked about. The more you test it and the more people you get to look at it and write theorems and papers about size of the search space, results from various attacks and so forth, the better.
deleted 14y ago
[deleted]
mcantelon 14y ago
Peer review.
jlarocco 14y ago
If they had talked about storing unsalted passwords in the first place, this whole thing may not have happened because somebody would have told them, "Hey, that's dumb" before the leak.
- larrys 14y ago
  We're talking about a major corporation here. They can pay for and hire the appropriate security experts (even more than one firm) and find something like that out.
  - jlarocco 14y ago
    If they weren't competent enough to do that before, what makes you think they're competent enough to do it now? For all we know, they've "fixed" the issue by switching to unsalted MD5 password hashes.