4 ms·

Security through obscurity is never the solution.

scott_s 14y ago
Obscurity is necessary for fraud prevention. If perpetrators know exactly what behavior gets flagged as fraud, it's easier for them to figure out ways to avoid it. If they don't know, perpetrating fraud is harder.
- reidmain 14y ago
  That is a good point. It honestly slipped my mind. Thanks for pointing that out.
dasil003 14y ago
You're cargo culting on security dogma. Information assymetry is probably your only advantage against credit card fraudsters, because there is no security hole, rather they are exploiting your core business flow.
- whit537 14y ago
  I want to explore openness wrt fraud prevention, not out of a facile rejection of "security through obscurity," but as part of Gittip's identity as an open company. It's accepted doctrine that "information asymmetry is probably your only advantage." I'm asking: can we be open about fraud prevention and prevent fraud? If we can be, we should. What are your thoughts on the value of the social graph in spotting suspicious accounts? It seems to me that we should be able to whitelist new accounts based on a review of GitHub or Twitter profiles, and perhaps for flagged accounts we "authorize without capturing," as dangrossman suggests above.
  - dasil003 14y ago
    I admire your motives, but I can't offer much encouragement. My experience is that there is no such thing as preventing fraud in the absolute sense. It's not a binary proposition—maybe general security isn't either, but it's a hell of a lot less gray than credit card fraud. So while I think it's good for general fraud prevention techniques and information to be widely disseminated, I can't in good conscience discuss specifics of techniques that I've employed because those would be easily traceable to companies I've worked for, and thus would impose an undue cost on them. A lot of people who have worked on these issues are probably in similar position where we'd be happy to go into details over a beer but not on public record.
- reidmain 14y ago
  It may be the only thing I can do to help mitigate credit card fraud but is it not the solution to preventing it. Credit card companies should be operating on the theory that people freely throw around their credit card number (because, let's face it, a lot of people do) and come up with solutions that do not rely on hiding that information. Obscurity of process/information can definitely be a benefit to the security of a system but it should not be the solution. The system should be designed for the absolute worst case scenario where this process/information could be exposed. I realize this can only go so far until at some point there is going to be some sort of secret that needs to be kept (i.e. physical hardware key, encryption codes, etc) where if this is cracked your system is exposed and at that point you need to have some sort of plan B to regain control and minimize damage.
  - dasil003 14y ago
    This is gobbledygook. You are still thinking in terms of security, but with credit card fraud there is no security issue or system to be cracked per se. Rather it's an identity and information problem. You can impose additional steps to vet the legitimacy of a transaction, but there is nothing that can ever give you a 100% guarantee. So you have to balance your efforts at vetting the transaction against usability barriers that add friction to your core business function. The difference between publishing your techniques (even with specific variables hidden) and often the difference between attackers being able to iteratively determine the minimum work around to get desired results and having to dedicate orders of magnitude more effort than necessary to ensure they are flying under the radar.
    - reidmain 14y ago
      You're correct. I was not thinking about conning the system but actually breaking into it which is obviously a lot harder. It is a lot easier to look at ways to dupe the algorithms for determining fraud rather than breaking the system and bypassing them. Thanks for opening my eyes.
      - dasil003 14y ago
RickHull 14y ago
The maxim is that you cannot achieve security through obscurity, where security offers some guarantees (mathematical, physical, etc.). Obscurity, while offering little to no guarantees, can certainly be a quite useful part of your protection plan.
- reidmain 14y ago
  You're 100% correct Rick. I should have been more explicit in my original post. It was a quick glib comment that I should have put a bit more thought into. There is a reason people don't go around wearing their credit card numbers and SIN on their clothes. The system to protect them should be setup to work its best in the scenario this information is completely exposed but our attempts to hide his information does add a tangible benefit.
rm999 14y ago
This is true if a system can freely be reverse-engineered by the attacker. If not, the obscurity provides an added cost to the attacker. Obscurity can actually be one of the stronger weapons in an anti-fraud solution (I used to work in anti-fraud).
- reidmain 14y ago
  Yeah like scott_s pointed out I did not consider anti-fraud. In my quick glib reaction comment I did not consider all scenarios. Thanks for pointing this out.
TheAmazingIdiot 14y ago
Since your HN password is obscure, how bouts you publicise it here? After all, hidden passwords are security through obscurity, and that's "just the wrong way".
- reidmain 14y ago
  True, it is the wrong way. Ideally there would be a better system for this kind of thing. It is the reason why physical authenticators and two phase authentication are becoming more popular.
darkarmani 14y ago
Just stop. There are so many layers of security that use obscurity. Most basic example is not exposing valid account usernames during failed logins.
- reidmain 14y ago
  I will. I have been flayed by other HNers and made aware of my ignorant position.

Obscurity is necessary for fraud prevention. If perpetrators know exactly what behavior gets flagged as fraud, it's easier for them to figure out ways to avoid it. If they don't know, perpetrating fraud is harder.

reidmain 14y ago
That is a good point. It honestly slipped my mind. Thanks for pointing that out.

dasil003 14y ago

You're cargo culting on security dogma. Information assymetry is probably your only advantage against credit card fraudsters, because there is no security hole, rather they are exploiting your core business flow.

whit537 14y ago
I want to explore openness wrt fraud prevention, not out of a facile rejection of "security through obscurity," but as part of Gittip's identity as an open company. It's accepted doctrine that "information asymmetry is probably your only advantage." I'm asking: can we be open about fraud prevention and prevent fraud? If we can be, we should. What are your thoughts on the value of the social graph in spotting suspicious accounts? It seems to me that we should be able to whitelist new accounts based on a review of GitHub or Twitter profiles, and perhaps for flagged accounts we "authorize without capturing," as dangrossman suggests above.
- dasil003 14y ago
  I admire your motives, but I can't offer much encouragement. My experience is that there is no such thing as preventing fraud in the absolute sense. It's not a binary proposition—maybe general security isn't either, but it's a hell of a lot less gray than credit card fraud. So while I think it's good for general fraud prevention techniques and information to be widely disseminated, I can't in good conscience discuss specifics of techniques that I've employed because those would be easily traceable to companies I've worked for, and thus would impose an undue cost on them. A lot of people who have worked on these issues are probably in similar position where we'd be happy to go into details over a beer but not on public record.
reidmain 14y ago
It may be the only thing I can do to help mitigate credit card fraud but is it not the solution to preventing it. Credit card companies should be operating on the theory that people freely throw around their credit card number (because, let's face it, a lot of people do) and come up with solutions that do not rely on hiding that information. Obscurity of process/information can definitely be a benefit to the security of a system but it should not be the solution. The system should be designed for the absolute worst case scenario where this process/information could be exposed. I realize this can only go so far until at some point there is going to be some sort of secret that needs to be kept (i.e. physical hardware key, encryption codes, etc) where if this is cracked your system is exposed and at that point you need to have some sort of plan B to regain control and minimize damage.
- dasil003 14y ago
  This is gobbledygook. You are still thinking in terms of security, but with credit card fraud there is no security issue or system to be cracked per se. Rather it's an identity and information problem. You can impose additional steps to vet the legitimacy of a transaction, but there is nothing that can ever give you a 100% guarantee. So you have to balance your efforts at vetting the transaction against usability barriers that add friction to your core business function. The difference between publishing your techniques (even with specific variables hidden) and often the difference between attackers being able to iteratively determine the minimum work around to get desired results and having to dedicate orders of magnitude more effort than necessary to ensure they are flying under the radar.
  - reidmain 14y ago
    You're correct. I was not thinking about conning the system but actually breaking into it which is obviously a lot harder. It is a lot easier to look at ways to dupe the algorithms for determining fraud rather than breaking the system and bypassing them. Thanks for opening my eyes.
    - dasil003 14y ago

RickHull 14y ago

The maxim is that you cannot achieve security through obscurity, where security offers some guarantees (mathematical, physical, etc.). Obscurity, while offering little to no guarantees, can certainly be a quite useful part of your protection plan.

reidmain 14y ago
You're 100% correct Rick. I should have been more explicit in my original post. It was a quick glib comment that I should have put a bit more thought into. There is a reason people don't go around wearing their credit card numbers and SIN on their clothes. The system to protect them should be setup to work its best in the scenario this information is completely exposed but our attempts to hide his information does add a tangible benefit.

rm999 14y ago

This is true if a system can freely be reverse-engineered by the attacker. If not, the obscurity provides an added cost to the attacker. Obscurity can actually be one of the stronger weapons in an anti-fraud solution (I used to work in anti-fraud).

reidmain 14y ago
Yeah like scott_s pointed out I did not consider anti-fraud. In my quick glib reaction comment I did not consider all scenarios. Thanks for pointing this out.

TheAmazingIdiot 14y ago

Since your HN password is obscure, how bouts you publicise it here? After all, hidden passwords are security through obscurity, and that's "just the wrong way".

reidmain 14y ago
True, it is the wrong way. Ideally there would be a better system for this kind of thing. It is the reason why physical authenticators and two phase authentication are becoming more popular.

darkarmani 14y ago

Just stop. There are so many layers of security that use obscurity. Most basic example is not exposing valid account usernames during failed logins.

reidmain 14y ago
I will. I have been flayed by other HNers and made aware of my ignorant position.