4 ms·

Its possible that "security by obscurity" has a different meaning in the programming world. When talking about computer or network security it is used to descri

• dllthomas 13y ago
  For what it's worth, Wikipedia disagrees: "Security through obscurity is generally a pejorative term referring to a principle in security engineering, which attempts to use secrecy of design or implementation to provide security." http://en.wikipedia.org/wiki/Security_through_obscurity http://en.wikipedia.org/wiki/Security_through_obscurity "When talking about computer or network security it is used to describe any mechanism that attempts to defend a system by hiding something." That is again a definition which would include ssh keys, which is to say a useless definition. "One of the classic examples of security by obscurity is when a person disables the broadcasting of the SSID on a wireless router." I'm not sure that's an example at all, since hidden SSIDs can be readily sniffed from a publicly documented protocol.
  • phaus 13y ago
    >That is again a definition which would include ssh keys, which is to say a useless definition. For those of us who work in security, its taken for granted that when we are talking about security through obscurity, we aren't talking about passwords and cryptographic keys. I should have been more clear. >"Security through obscurity is generally a pejorative term referring to a principle in security engineering, which attempts to use secrecy of design or implementation to provide security." That's the exact same thing that I said worded in a different way. >I'm not sure that's an example at all, since hidden SSIDs can be readily sniffed from a publicly documented protocol. And that's the entire point. Security through obscurity alone is not a good thing. Starting from the second sentence, and continuing through to the second and third paragraphs, the article elaborates on this. >A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them. >Security through obscurity has never achieved engineering acceptance as an approach to securing a system, as it contradicts the principle of simplicity. The United States National Institute of Standards and Technology (NIST) specifically recommends against security through obscurity in more than one document. Quoting from one, "System security should not depend on the secrecy of the implementation or its components."[1] >It is analogous to a homeowner leaving the rear door open, because it cannot be seen by a would-be burglar.
    • dllthomas 13y ago
      It worries me a tiny bit that you work in security, and yet your thinking seems this muddled here. I'm hoping you haven't had your coffee or it's a failure of communication or something... "its taken for granted that when we are talking about security through obscurity, we aren't talking about passwords and cryptographic keys." I agree that passwords and cryptographic keys are not what we're talking about - the question is why. Whether, confronted with a proposed setup that relies on the secrecy of X for its security, whether X should be seen as analogous to keys (and thus not a case of "security through obscurity"), or more analogous to protocol or algorithm (and thus a case of "security through obscurity"). There are, of course, other concerns as well. "That's the exact same thing that I said worded in a different way." SSID is neither design nor implementation of a wireless network. "Security through obscurity alone is not a good thing." I wholeheartedly agree that security through obscurity is not a good thing, but not everything that is bad is "security through obscurity". "Don't broadcast secrets from radios in cleartext" is a rather simpler (and stronger!) rule violated here if you are trying to use SSID as a secret.
      • phaus 13y ago
        >SSID is neither design nor implementation of a wireless network. As it relates to the physical implementation of a network, part of the implementation includes configuring the devices. Security through obscurity can be something as simple as manually assigning a non-standard port to a service (such as HTTP). The example of disabling the broadcast of an SSID is also a valid example of security through obscurity. You seem to have an issue with me using the SSID as an example because its so easy to defeat that it would be a waste of time to even try. Like I said before, that's the entire point. Its obvious to us now, in 2014, but for years people were told by 'experts' to disable it as a security measure. Some individuals actually used to attempt to secure their networks by hiding the SSID instead of using a password. The prevalence of this kind of negligence is one of the key reasons that disabling the broadcast became the prototypical example used to explain why security through obscurity doesn't work. In short, its not an example I made up on my own formed from a lack of understanding security, its an example that's used in textbooks and security-specific certification study guides. Its an example that's taught in introductory IT and IT security classes. I'll try to find some more specific citations to put your mind at ease, its been quite a while since I've taken an introductory course on the subject. https://www.owasp.org/index.php/Avoid_security_by_obscurity https://www.owasp.org/index.php/Avoid_security_by_obscurity >not everything that is bad is "security through obscurity". And I agree with this, but my example most certainly is a valid case of security through obscurity. Update: Better Sources From Hacking Exposed: Wireless, 2nd Edition Pg. 80 From the first paragraph on security through obscurity: >Many wireless networks today operate in hidden or nonbroadcasting mode. These networks don’t include their SSID (network name) in beacon packets, and they don’t respond to broadcast probe requests. People who configure their networks like this think of their SSID as a sort of secret. People who do this might also be prone to enabling MAC address filtering on the AP. From Enterprise Security: A Data-Centric Approach, Chapter 7 >In order to provide security through obscurity, methods such as hidden SSIDs and MAC address filtering have been employed to keep the wireless network invisible to eavesdroppers and more difficult to connect to for an unknown host. From Certified Wireless Design Professional Official Study Guide, Section titled SSID hiding. >In order to provide security through obscurity, methods such as hidden SSIDs and MAC address filtering have been employed to keep the wireless network invisible to eavesdroppers and more difficult to connect to for an unknown host. These are just a few examples out of dozens, if not hundreds. I'd sincerely appreciate it if you would educate yourself before implying that other people are incompetent in the future.