4 ms·
To be fair though, all security is about obscurity. The questions is just how obscure. One could certainly argue that using bcrypt instead of SHA-1 without salt
by Yrlec 14y ago
To be fair though, all security is about obscurity. The questions is just how obscure. One could certainly argue that using bcrypt instead of SHA-1 without salting is a lot more important than not disclosing your security practices but they are not mutually exclusive.
- dag11 14y agoTLS is secure, right? TLS is by no means obscure. Good security does not need to be obscure. If it does, that means that it can be defeated if its methods are known, which doesn't sound like very good security to me.
- Negitivefrags 14y agoAll security is about obscurity because it involves having a secret that you don't believe anyone else can get. (ie; a password, a private key, cert, a random number, a physical object).
- jacobwil 14y agoThat isn't what security through obscurity ever means though. You're taking the words at face value while everyone else is using the words for what they actually mean. Security by obscurity doesn't refer to the secrets used as keys but instead to the way those keys are stored used to perform authentication.