"As we all know security through obscurity only buys you time..." No. Your definition of "security through obscurity" is totally wrong, so your sentence makes

"As we all know security through obscurity only buys you time..." No. Your definition of "security through obscurity" is totally wrong, so your sentence makes zero sense. If I say: "This server uses port-knocking, you must on three ports between 1..65535 in the correct order before you can attempt to login using SSH on an unknown port" There is absolutely zero security through obscurity here. Just as there's zero security through obscurity when someone says: "I've got a server with SSH on port 22 open, you need a login/password to get in". Attackers do not know the login/password but that is still certainly not "security through obscurity". Just as attackers do not know which three-ports knocking sequence they should use to log in. All they know is that they'll first need to try to find the correct port-knocking sequence amongst the 65536 exp 3 possibilities before being able to try to find the SSH port and then try to force the login/password. Just as using a random SSH port is certainly not "security through obscurity". Security through obscurity is when there's a design or an implementation detail that is obscured. Like when a snake-oil vendors creates a "one-password to store them all" website and doesn't say how it's doing the storing / encryption / authentication / etc. That is security through obscurity. Saying: "You need to know the secret root password to login" or "You need to know the secret port-knocking sequence before the SSH port shall allow" is not, has never been and shall never be "security through obscurity".