3 ms·
The fact is that sometimes security through obscurity works. Take Skype for example, it was well known that the US government had for a long time wanted access
by a_b__ 13y ago
The fact is that sometimes security through obscurity works. Take Skype for example, it was well known that the US government had for a long time wanted access and, depending on who you ask, failed. After being bought by MS and reconfigured, it could be argued that there are now fewer access problems.
Where obscurity fails is where the product has been poorly designed in the first place - perhaps due to lack of time or manufacture costs - or there is a failure to update when the scenario or environment for which it was built changes.
Obscurity is really a term about confidence and PR of a system (eg. ISO standards compliant?) or company (RSA anyone?). How does the company convince you that it is using best practices without compromising its competitive advantage?
The grumbles about running Windows98 are pointless if the system meets the requirements.
- betterunix 13y ago"Take Skype for example, it was well known that the US government had for a long time wanted access and, depending on who you ask, failed. After being bought by MS and reconfigured, it could be argued that there are now fewer access problems." That is not a security through obscurity success story. The Skype design was changed by Microsoft in a way that made government access easier. "How does the company convince you that it is using best practices without compromising its competitive advantage?" Your competitive advantage is not my problem. I need a secure voting machine, a secure ATM, a secure medical database, etc. If you cannot deliver a secure system to me in a way that allows me to verify its security, then you never had a competitive advantage in the first place.