3 ms·

verb: keep from being seen; conceal. In what way is what he’s describing not obscurity?

cnity 2y ago
It is about the existence or the methodology being obscured, not the contents of an encrypted message. The point of that phrase is to contrast one type of security for another. You and I can know exactly what tool was used to encrypt something, and all the mathematics behind it, but still fail to decrypt it without the requisite private key.
DrammBA 2y ago
In every way, because context matters, and the original commenter intentionally recontextualized it just to be contrarian.
- buuuuuut 2y ago
  [dead]
dghlsakjg 2y ago
Yes that is what the word obscure means. But the phrase “security through obscurity” is an industry term that refers to keeping things secure purely by not letting people know they exist. In contrast with encryption, where I can tell you exactly where the encrypted data is, but you can’t access it. Security through obscurity is hiding a bicycle in a bush and hoping no one notices it, encryption is more like locking it to a bike rack with a very good lock.
- buuuuuut 2y ago
  [dead]
MyOutfitIsVague 2y ago
Two points: 1. Encrypted data is not hidden. You still know that there is data, it's just in a form that you can't understand. Just as difficult higher-level math isn't "obscured" from a non-mathematician (who knows that it is math, but can't decode it), encrypted data is not obscured. 2. You could make the argument that the data is actually hidden, but the fact that data is there is not hidden. This is pointless pedantry, though. It is both contrary to the way that everybody uses the word and stretches the meaning of the word to the point that it's not useful. There is a common understanding of what "Security through obscurity" means ( https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity ) and interpreting it far beyond that is not useful. It simply breaks down communication into annoying semantic arguments. I enjoy semantic arguments, but not tedious, pedantic ones where one person just argues that a word isn't what everybody understands it to mean. More specifically, it's about WHAT is being obscured. "Security through obscurity" is about trying to be secure by keeping the details or mechanisms of a system secret, not the data itself.
- genewitch 2y ago
  Running your SSH server on port 8822 is security through obscurity. Port knocking isn't, I don't think.
Minor49er 2y ago
This was explained in the third sentence of the post that you're responding to
ewmiller 2y ago
You wouldn’t call a room behind a locked door “obscured.” Even if it’s technically correct in the most stretched definition (which I’m not convinced of), either way it’s not how people actually use the word.

It is about the existence or the methodology being obscured, not the contents of an encrypted message. The point of that phrase is to contrast one type of security for another. You and I can know exactly what tool was used to encrypt something, and all the mathematics behind it, but still fail to decrypt it without the requisite private key.

DrammBA 2y ago

In every way, because context matters, and the original commenter intentionally recontextualized it just to be contrarian.

buuuuuut 2y ago
[dead]

dghlsakjg 2y ago

Yes that is what the word obscure means. But the phrase “security through obscurity” is an industry term that refers to keeping things secure purely by not letting people know they exist. In contrast with encryption, where I can tell you exactly where the encrypted data is, but you can’t access it. Security through obscurity is hiding a bicycle in a bush and hoping no one notices it, encryption is more like locking it to a bike rack with a very good lock.

buuuuuut 2y ago
[dead]

MyOutfitIsVague 2y ago

Two points: 1. Encrypted data is not hidden. You still know that there is data, it's just in a form that you can't understand. Just as difficult higher-level math isn't "obscured" from a non-mathematician (who knows that it is math, but can't decode it), encrypted data is not obscured. 2. You could make the argument that the data is actually hidden, but the fact that data is there is not hidden. This is pointless pedantry, though. It is both contrary to the way that everybody uses the word and stretches the meaning of the word to the point that it's not useful. There is a common understanding of what "Security through obscurity" means ( https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity ) and interpreting it far beyond that is not useful. It simply breaks down communication into annoying semantic arguments. I enjoy semantic arguments, but not tedious, pedantic ones where one person just argues that a word isn't what everybody understands it to mean. More specifically, it's about WHAT is being obscured. "Security through obscurity" is about trying to be secure by keeping the details or mechanisms of a system secret, not the data itself.

genewitch 2y ago
Running your SSH server on port 8822 is security through obscurity. Port knocking isn't, I don't think.

Minor49er 2y ago

This was explained in the third sentence of the post that you're responding to

ewmiller 2y ago

You wouldn’t call a room behind a locked door “obscured.” Even if it’s technically correct in the most stretched definition (which I’m not convinced of), either way it’s not how people actually use the word.