5 ms·

If they're relying on such information for security, they aren't secure in the first place.

• pyre 13y ago
  I think that the idea is to not help out a potential attacker rather than to use this as an absolute security method. I think that we can agree that relying on any single security method is foolish. Maybe we shouldn't jump to conclusions that this is their only security measure in place.
• lhgaghl 13y ago
  If they're relying on multiple weak pieces of information like this for security, they still aren't secure, and now they just created a huge pain in the ass for any user of their system, as they have to somehow know all the pieces of information which are supposed to be secret. Huge-pain-in-the-ass security doesn't tend to work very well...
• danielweber 13y ago
  They don't have to be "relying" on it to use it. If you treat security like a mathematical problem [1] with no grey areas, you are going to reject almost every security measure and say "that would only give users a false sense of security." Just about all security measures can be worked around by a determined attacker. That doesn't mean you stop using them. The linked page says to hide your whois information. This is surely security through obscurity. Yet it can vastly reduce the number of reset emails you get. [1] You should treat crypto like a mathematical problem.
  • oh_sigh 13y ago
    Also known as "defense in depth" in the security field.
  • Dylan16807 13y ago
    To be picky, if you're treating it mathematically the phrase "sense of security" has no meaning.