5 ms·

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bu

• staticassertion 5mo ago
  I don't think that really works because obscurity isn't harder to see or find. I don't know the analogy, it's like standing out in the open and being like "yeah but who would think to look here lol".
  • willis936 5mo ago
    I think you're misinterpreting "obscurity" for "lack of obscurity". If you have a vulnerability in an API interface that is completely undocumented that is a vulnerability that is obscured. It's hiding in the woods, not standing in a field. To keep with the analogy: no one is going to stand in a field when people are shooting at you. So then why do a small subset of vocal people online suggest that you just put your bulletproof vest and claim that hiding in the woods, regardless of the vest, is a bad idea?
    • staticassertion 5mo ago
      This isn't about what's a good idea or bad idea. Perhaps it's best to simply leave analogies behind, otherwise we'll just focus on the wrong thing. Security through obscurity merely means that your system is atypical. It's not hidden, it's not secret, it's not hard to find, it's not hard to examine, it's not less visible, etc - there is nothing inherently different about the systems at all other than that one is more common than the other. It's just less typical.
      • willis936 5mo ago
        What you're describing is a thing that is not obscured. Don't refer to things as obscured if they are not obscured. When others talk about about things that are obscured they are talking about things that are obscured, not things that are not obscured.
        • staticassertion 5mo ago
          You can see my other comment on this. The word "obscure" is not very relevant to the phrase "security through obscurity".
        • deleted 5mo ago
          [deleted]
      • dreambuffer 5mo ago
        I'm having a hard time understanding what you mean here. If something is obscured, by definition it is less visible. Being 'less typical' is a form of security because most attacks rely on some form of pattern recognition, and obscurity literally dissolves patterns into noise.
        • staticassertion 5mo ago
          You're overly focusing on the term and not the meaning. The term comes about from people choosing tools like "foxit" or "Opera" and saying that those products are safer than their cohorts Adobe/ Firefox because they are attacked less often. This notion was termed "security through obscurity" ie: "you use the less popular option, therefor that option is safer". It has nothing to do with "obscuring" in the sense of "hiding", that's a linguistic quirk of a colloquial term. If you were actually taking action to reduce the ability to understand a system in a way that you could meaningfully defend, it would no longer be "security through obscurity". The argument has persisted because there are two different questions that sound the same (X is less typical than Y): 1. Is "X" safer than "Y"? 2. Is a user of "X" safer than a user of "Y"? When looking at (1) in isolation, you can say things like "X lacks security features, therefor Y is safer" and "X is less often used, therefor X is safer", etc. This is a question about the posture of the project itself, in isolation. (2) is about the context for users. The reality is that X, which perhaps is fundamentally less well built software, may actually have users who are attacked far less frequently. Both are likely to favor "rarity is a poor indicator of safety" as we generally reject mitigation approaches that rely on attackers to behave specific ways, but what's important is that these are completely different questions and neither has to do with being obscured but rather rare. None of this is about what is "obscured" or not. If something is obscured or obfuscated, that is a technique that can be evaluated separately by its own merits (ie: how hard is deobfuscation, how easy is it to adapt to deobfuscation, etc). All of this is about whether you're evaluating (1) or (2) - and in the case of (1), which is what the criticism always has focused on, the answer is that "rarity" is not a mitigation.
    • arcfour 5mo ago
      You know when people are shooting at you. You don't know when or if people are exploring undocumented/obscure features of your system and what they have learned about it that you were trying to hide. Therefore, the safest assumption to make is that an adversary already has figured out all of your obscurity, because they always can do this given sufficient time and interest, at which point the only thing between them and you is your security. That is why we design systems without obscurity and only care about security.
      • willis936 5mo ago
        I agree that it's a good principle but it's taken too far when justifying needlessly growing risk surface area. Like the principle is useful to justify security hardening. It is not useful when used to increase the odds of being attacked.
      • adrian_b 5mo ago
        Security is mandatory. Obscurity is optional. Obscurity is not worthwhile when it increases your own costs. Nevertheless, if you can add obscurity with negligible additional cost and inconvenience, then you should do it.
  • singpolyma3 5mo ago
    The first rule of not being seen: to not stand up.
    • gerdesj 5mo ago
      Not stand out.
  • m3047 5mo ago
    Interesting. Have you seen the movie Braveheart? That's the leadup to the later humiliation of the king in battle, there's a movie / drama about this one too. Saw it recently, don't remember the name. Basically the insurgents choose terrain they know well, because they live there. They choose a swamp / mire in an open field between two hills. They build fortifications. They obscure the true nature of the ground they're standing on, out in the open. They goad the king's army into finishing them then and there. They fight on foot against knights on horseback. It's a mess. They win.
• mday27 5mo ago
  This is an especially good analogy because facing a well-resourced adversary in cybersecurity is like finding out that the enemy brought artillery -- hopefully you weren't relying entirely on obscurity because pretty soon there will be nowhere to hide
  • cindyllm 5mo ago
    [dead]
  • TeMPOraL 5mo ago
    Funny analogy, in that when the high caliber shells start raining, most forms of cover won't make a difference. The ones that will, are not something you want to stay behind on days when you're not being actively bombed. In fact, keeping you behind such protections is by itself a military tactic - it lets the enemy roam freely and maneuver around you. But the basic flaw of this analogy is that it implies you're at war, and your system is always in battle.
• lucketone 5mo ago
  All modes of cyber security depend on some obscurity (e.g. password) Ideally we want a viable plan B, for when it’s leaked/figured out. (E.g. generate new passwords) (For convenience let’s label air-gap as kind of physical security)
  • 0123456789ABCDE 5mo ago
    i don't know a lot about the subject, but the little i know tells me this is not the way to look at this your password (plain text) is secret because only you are supposed to a have it. in the digital realm, sharing the contents of the password (plain-text) is be akin to making a copy of it — undesirable now, the algorithm that hashes the plain-text for comparison with the stored hash, that can be know by anyone, and typically is so password ≠ hashing algorithm
    • lucketone 5mo ago
      Yes. Password and hashing algorithm are distinct things. I fully agree with you.
  • pdpi 5mo ago
    > All modes of cyber security depend on some obscurity (e.g. password) That's not what the expression means. "Security through obscurity" has a very specific meaning — that your system's security depends on your adversary not understanding how it works. E.g. understanding RSA is a few wikipedia articles away, and that doesn't compromise its security, so RSA isn't security through obscurity.
    • sroussey 5mo ago
      No, "Security through obscurity" is a valid and useful layer. A lot of weight hangs on your word “depends” though, in which case if it is the only layer then you will eventually have, uh, problems. I’ve used it for a long long time. Like in 1999 I’d have a knock on certain ports in a certain order to unlock the ssh port. And lots of weird stuff to stop forum spam. Which could work for weeks or months or even a year.
• walrus01 5mo ago
  Because I love how seriously the DoD takes newly invented terms, we have: "The Integrated Survivability Onion" https://cogecog.com/the-threat-onion/ https://cogecog.com/the-threat-onion/ 1. Don't be seen. 2. Don't be acquired 3. Don't be hit 4. Don't be penetrated 5. Don't be killed It's actually not a bad mental model training aid for teaching people who might find themselves in an active combat environment.
  • Maxion 5mo ago
    Works just as well anywhere, really.
  • TZubiri 5mo ago
    The acquired concept is new to me, is this an established term?
    • walrus01 5mo ago
      in the sense of one military force contacting another, yes, as in acquiring a target.
  • trashb 5mo ago
    I feel like "Don't be captured" should be included, perhaps between 4 and 5. In cybersecurity this would be applicable to ransomware.
    • red-iron-pine 5mo ago
      the implication of the "don't be acquired" and "don't be penetrated" is some sort of anti-air or anti-tank missile. "killed" in this case would be equivalent to having something penetrate and hit sensitive systems. at that point it's basically just a function of what the penetrator is trying to do -- if they just want $$$ they ransomware. if they want exfil or DoS or making critical systems do naughty things that is also a kill.
      • walrus01 5mo ago
• m463 5mo ago
  I kind of wonder if the analogy might also carry over to the age of AI. if you were hiding in cover during ww1, maybe you had a chance. But if you were hiding from the Terminator, who is "Tireless, Fearless, Merciless", it might not last that long. same might be said of exploits hiding from people... vs AI.
• Lammy 5mo ago
  > Obscurity can be fine but it's not security. All security is security through obscurity. When it gets obscure enough we call it “public key cryptography”. Guess the 2048-bit prime number I'm thinking of and win a fabulous prize! (access to all of my data)
• red369 5mo ago
  Well off-topic, but did you recently listen to Andy Stumpf on a podcast? Asking because of the Baader–Meinhof phenomenon :)
  • shric 5mo ago
    > Asking because of the Baader–Meinhof phenomenon :) I recently learned about that and now I see it everywhere, weird.
• neoCrimeLabs 5mo ago
  Agreed with your sentiment, and that was a great example. Just like any security control, if it's your only means of security, it will not offer much risk reduction. Just like all security controls, the if you want risk reduction use more security controls together. Like all security controls, there is no way to eliminate risk, just reduce it as much as possible while still being able to effectively achieve your mission. Because of this I believe security through obscurity to be important component in a healthy and mature risk posture. It irks me when it's dismissed because obscurity is not security. No single security control is security on its own.
  • Maxion 5mo ago
    Obscurity by itself does provide risk reduction. Think about leaving your bike unlocked in times square, vs. the top of a 7 000 meter mountain in the himalayas. Which unlocked (unsecure) bike is more likely to be stolen, and ergo has a lower risk attached? ---- Obscurity does not help you when the thief has already found your bike, nor is obscurity very helpful for keeping your bike safe if you happen to live in times square. But if you live at the top of a himalayan peak, you can be fairly certain you're not going to have your bike stolen.
    • red-iron-pine 5mo ago
      the security controls for a bike on a high mountain are not obscurity, they're the lack of oxygen (that kills), the cold (that kills), the height (that kills), and the literal sheer difficulty of getting there. you could put the bike right on the side of the mountain without any obfuscation and it won't get got because ain't no one gonna die for a bike. its like how we know where dead people are on Everest but we can't get them down; they serve as landmarks.
• 6r17 5mo ago
  The problem with that statement is that a lot of people who yield it fail to see the advantages that come with these extra shenanigans ; and let's just take pure concealment so I don't pushing weird arguments ; in the age of AI - each time we are able make an attacking AI misaligned we are essentially buying time ; an on-going attack is never a on-shot event ; it's an ongoing process where the attacker has to understand where it is located and what it can do ; since each element will be a resource ; do not let it have it in the first place. It's a bit of an elitist view of security that romanticize concepts without thinking about what they can actually be used for. My personal bad experience with that was a manager who was stating me that having a different subdomain for the admin panel was a concealment and not a security practice. I mean - it's very easy to see how this kind of argument actually prevents from doing something that can help just on the basis of philosophical purity - which often just miss the point - security is not a mechanism that will solve all your problems ; heck in fact I have to layer at least 4 mechanisms just on the http interface to feel safe ; it's more of a lot of layers that together form a barrier ; We sit too much on TLS thinking "That's it, security job is done" - then we get some crazy stuff like French ANTS that get pawned with some IDOR ; as IF f* using some hash or something ; ANYTHING PLEASE F* HELL ; would have not helped
• j45 5mo ago
  100%. Obscurity alone isn't security. Security that includes obscurity in it's architecture is relevant.
• raffraffraff 5mo ago
  Example: there are teenage gangs going around on high powered scooters in my city, carrying hammers and mini grinders. They pair up on a scooter, steal a bike and disappear. I watched them. They don't want to hang around longer than necessary. They will only approach a bike rack that is clearly visible from the road. They will only steal a bike that has unobstructed access to the road (no tricky bollards or other bikes to get around). Even though they are full of bravado, and shout obscenities and threats at me when I tell them to fuck off, they still run away (even though the one approaching the bikes is carrying a weapon while his companion stays on the scooter ready to escape) Anything that even mildly inconveniences these guys is enough to stop them attempting theft. The bikes they steal needs to be expensive, out in the open, with direct access to the road, and with a shitty lock. And believe it or not, those tumblers line up a lot. Throwing a blanket over a bike is probably enough to stop them from even approaching it.
  • canpan 5mo ago
    It's not great, but basically if your lock is better than the lock on the bicycle next to yours, they will most likely not steal yours..
    • kombookcha 5mo ago
      You only need to be faster than the slowest gazelle in the pack, right?
      • withinboredom 5mo ago
        Gazelle bikes are pretty fast ... instructions unclear.
        • ozim 5mo ago
          Following Dutch jokes: Well the lock itself for a junkie in Amsterdam has value if you get expensive one it is additional loot.
    • WhyNotHugo 5mo ago
• pamcake 5mo ago
  Obscurity isn't security but it can support security. Until it doesn't.
  • hackeraccount 5mo ago
    I think I got the difference in my head. How about this: Obscurity is decreasingly effective as more people use it. Security is more effective as more people use it.
• Byamarro 5mo ago
  Security through obscurity is mitigation basically. You reduce risk/impact, not eliminate it. There are problems - such as denial of wallet attacks - where you can only mitigate and can't eliminate the problem completely
• TZubiri 5mo ago
  >Obscurity can be fine but it's not security You literally just read how Obscurity protected OP in a cybersecurity incident. Now you are just playing word games, which are a waste of time.
  • tgv 5mo ago
    It does seem to be a word game, because "it's not stopping any bullets" either isn't honest (it does stop bullets from hitting you when the enemy doesn't know where to shoot) or it's limited, just like obscurity is ("it may stop a few bullets, but it won't stop all, and there will be other weapons it can't stop either"). I think public key exchange is considered security, but it still requires to obscure your private keys. Perhaps a better word would be resistance (to intrusion), which is a dimension orthogonal to visibility.