3 ms·

I wish this trend of “security through obscurity” should mean that all info should just be exposed would die, its silly and lacks basis in reality. Even within

by dijit 1y ago

I wish this trend of “security through obscurity” should mean that all info should just be exposed would die, its silly and lacks basis in reality. Even within infosec, certain types of information disclosure are considered security problems. Leaking signed up user information or even inodes on the drives can lead to PCI-DSS failures. Why is broadcasting your records treated differently? Because people would find the information eventually if they scanned the whole internet? Even then they might not due to SNI; so this is actually giving critical information necessary for an attack to attackers.

augusto-moura 1y ago
The issue is not that obscurity per se is bad, but relying _only_ on obscurity is absolute the same as not having any security measures at all. With the public ledger or not, you will still need to implement proper security measures. So it shouldn't matter if your address is public or not, in fact making it public raises the awareness for the problem. That's the argument.
- Lammy 1y ago
  > relying _only_ on obscurity Until it gets obscure enough that we start calling it “public-key cryptography”. Guess the prime number I'm thinking of between 0 and 2↑4096 and win a fabulous prize!
  - tux3 1y ago
    If you replace "security by obscurity" with "Kerckhoffs's principle", yes, absolutely! The problem with using regular everyday obscurity is that it usually has a small state space and makes for terrible security, but people will treat it like it is cleverly hidden and safe from attackers If I guess the IPv4 you're thinking of between 0 and 2↑32, ready or not, you win a free port scan
  - gf000 1y ago
    As per another comment, we can scan a single port on every public IPv4 address in less than an hour. Trying every 256bit number gets into a "slightly" larger problem.
- bb88 1y ago
  > So it shouldn't matter if your address is public or not, in fact making it public raises the awareness for the problem. That's the argument. Forget about the internet, we've had almost 100 years to prove we can secure identity theft. And the best thing we can do is to keep our SSN's secret -- security through obscurity. Keeping your SSN private reduces your personal attack surface. We've had 50 years to secure the internet, and yet, we still have zero day attacks. Nuclear submarines try their best to keep their locations a secret? Why? You cannot attack something you cannot see or hear.
  - gf000 1y ago
    Except we are more on a chess table where we can just trivially probe each cell, unlike the vast volume of the ocean.
    - dijit 1y ago
      A game of battleship is indeed a good analogy! Just because its a finite space that may eventually be discovered is a poor reason to announce where things are!
      - augusto-moura 1y ago
        Battleship sounds like a good analogy, but is very different because you don't have other options to "secure your ship" besides obscurity. If you had other options, let's say a sonar or moving your ship, they would definitely be used along with obscurity. Besides, the time to scan the whole board is too time consuming in a battleship game, but scanning the whole internet on the other hand only take a few minutes[1] [1]: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan
        bb88 1y ago
        You're talking IPv4 here, not IPv6. A 24 bit network has 254 addresses in IPv4. A 64bit subnet in IPv6 has 2^64. If you can scan 1M ipv6's in a second, you can maybe scan 1 subnet in 584,942 years. So if you're a firewall, and you notice scanning from a particular ip or network, it's easy enough to block them. Also if you are scanning IPv4, you're not scanning addresses behind the NAT'd routers -- which is also effectively a form of obfuscation. So I would argue it's not the entire internet.
yjftsjthsd-h 1y ago
Okay, but we're not talking about that here. This is very much the case of a service being exposed that shouldn't be and relying on obscurity to try and avoid actually getting compromised
- dijit 1y ago
  ironically I would double down even harder then; If something was temporary then it’s likely that it wouldn’t have been found in a meaningful amount of time to be exploited. As an only line of defence it’s not good, but its also not good to hand-deliver your entire personal information to fraudsters and then claim that the systems should be more robust.
  - aspenmayer 1y ago
    If you have a target on your own back thanks to cert transparency logs, it's a bit like closing the barn door late for you to find fault in your own being in Texas when sharpshooters are about. If your only defense was obscurity, your ass is hanging out, and it's no one's fault but your own when you find fault with others for simply saying so. https://en.wikipedia.org/wiki/Texas_sharpshooter_fallacy https://en.wikipedia.org/wiki/Texas_sharpshooter_fallacy
    - dijit 1y ago
      In my original comment I said (I thought) quite clearly that obscurity as your only defence is a terrible idea. But painting a target on your back is not exactly justified just because hiding yourself isn’t a good defence in of itself.
      - aspenmayer 1y ago
        Obscurity couldn't be anyone's last/best defense, unless it was their only defense, was my point. In any case, I think we agree.

by dijit 1y ago

augusto-moura 1y ago

The issue is not that obscurity per se is bad, but relying _only_ on obscurity is absolute the same as not having any security measures at all. With the public ledger or not, you will still need to implement proper security measures. So it shouldn't matter if your address is public or not, in fact making it public raises the awareness for the problem. That's the argument.

Lammy 1y ago
> relying _only_ on obscurity Until it gets obscure enough that we start calling it “public-key cryptography”. Guess the prime number I'm thinking of between 0 and 2↑4096 and win a fabulous prize!
- tux3 1y ago
  If you replace "security by obscurity" with "Kerckhoffs's principle", yes, absolutely! The problem with using regular everyday obscurity is that it usually has a small state space and makes for terrible security, but people will treat it like it is cleverly hidden and safe from attackers If I guess the IPv4 you're thinking of between 0 and 2↑32, ready or not, you win a free port scan
- gf000 1y ago
  As per another comment, we can scan a single port on every public IPv4 address in less than an hour. Trying every 256bit number gets into a "slightly" larger problem.
bb88 1y ago
> So it shouldn't matter if your address is public or not, in fact making it public raises the awareness for the problem. That's the argument. Forget about the internet, we've had almost 100 years to prove we can secure identity theft. And the best thing we can do is to keep our SSN's secret -- security through obscurity. Keeping your SSN private reduces your personal attack surface. We've had 50 years to secure the internet, and yet, we still have zero day attacks. Nuclear submarines try their best to keep their locations a secret? Why? You cannot attack something you cannot see or hear.
- gf000 1y ago
  Except we are more on a chess table where we can just trivially probe each cell, unlike the vast volume of the ocean.
  - dijit 1y ago
    A game of battleship is indeed a good analogy! Just because its a finite space that may eventually be discovered is a poor reason to announce where things are!
    - augusto-moura 1y ago
      Battleship sounds like a good analogy, but is very different because you don't have other options to "secure your ship" besides obscurity. If you had other options, let's say a sonar or moving your ship, they would definitely be used along with obscurity. Besides, the time to scan the whole board is too time consuming in a battleship game, but scanning the whole internet on the other hand only take a few minutes[1] [1]: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan
      - bb88 1y ago
        You're talking IPv4 here, not IPv6. A 24 bit network has 254 addresses in IPv4. A 64bit subnet in IPv6 has 2^64. If you can scan 1M ipv6's in a second, you can maybe scan 1 subnet in 584,942 years. So if you're a firewall, and you notice scanning from a particular ip or network, it's easy enough to block them. Also if you are scanning IPv4, you're not scanning addresses behind the NAT'd routers -- which is also effectively a form of obfuscation. So I would argue it's not the entire internet.

yjftsjthsd-h 1y ago

Okay, but we're not talking about that here. This is very much the case of a service being exposed that shouldn't be and relying on obscurity to try and avoid actually getting compromised

dijit 1y ago
ironically I would double down even harder then; If something was temporary then it’s likely that it wouldn’t have been found in a meaningful amount of time to be exploited. As an only line of defence it’s not good, but its also not good to hand-deliver your entire personal information to fraudsters and then claim that the systems should be more robust.
- aspenmayer 1y ago
  If you have a target on your own back thanks to cert transparency logs, it's a bit like closing the barn door late for you to find fault in your own being in Texas when sharpshooters are about. If your only defense was obscurity, your ass is hanging out, and it's no one's fault but your own when you find fault with others for simply saying so. https://en.wikipedia.org/wiki/Texas_sharpshooter_fallacy https://en.wikipedia.org/wiki/Texas_sharpshooter_fallacy
  - dijit 1y ago
    In my original comment I said (I thought) quite clearly that obscurity as your only defence is a terrible idea. But painting a target on your back is not exactly justified just because hiding yourself isn’t a good defence in of itself.
    - aspenmayer 1y ago
      Obscurity couldn't be anyone's last/best defense, unless it was their only defense, was my point. In any case, I think we agree.