4 ms·

>SSID is neither design nor implementation of a wireless network. As it relates to the physical implementation of a network, part of the implementation include

by phaus 13y ago

>SSID is neither design nor implementation of a wireless network. As it relates to the physical implementation of a network, part of the implementation includes configuring the devices. Security through obscurity can be something as simple as manually assigning a non-standard port to a service (such as HTTP). The example of disabling the broadcast of an SSID is also a valid example of security through obscurity. You seem to have an issue with me using the SSID as an example because its so easy to defeat that it would be a waste of time to even try. Like I said before, that's the entire point. Its obvious to us now, in 2014, but for years people were told by 'experts' to disable it as a security measure. Some individuals actually used to attempt to secure their networks by hiding the SSID instead of using a password. The prevalence of this kind of negligence is one of the key reasons that disabling the broadcast became the prototypical example used to explain why security through obscurity doesn't work. In short, its not an example I made up on my own formed from a lack of understanding security, its an example that's used in textbooks and security-specific certification study guides. Its an example that's taught in introductory IT and IT security classes. I'll try to find some more specific citations to put your mind at ease, its been quite a while since I've taken an introductory course on the subject. https://www.owasp.org/index.php/Avoid_security_by_obscurity https://www.owasp.org/index.php/Avoid_security_by_obscurity >not everything that is bad is "security through obscurity". And I agree with this, but my example most certainly is a valid case of security through obscurity. Update: Better Sources From Hacking Exposed: Wireless, 2nd Edition Pg. 80 From the first paragraph on security through obscurity: >Many wireless networks today operate in hidden or nonbroadcasting mode. These networks don’t include their SSID (network name) in beacon packets, and they don’t respond to broadcast probe requests. People who configure their networks like this think of their SSID as a sort of secret. People who do this might also be prone to enabling MAC address filtering on the AP. From Enterprise Security: A Data-Centric Approach, Chapter 7 >In order to provide security through obscurity, methods such as hidden SSIDs and MAC address filtering have been employed to keep the wireless network invisible to eavesdroppers and more difficult to connect to for an unknown host. From Certified Wireless Design Professional Official Study Guide, Section titled SSID hiding. >In order to provide security through obscurity, methods such as hidden SSIDs and MAC address filtering have been employed to keep the wireless network invisible to eavesdroppers and more difficult to connect to for an unknown host. These are just a few examples out of dozens, if not hundreds. I'd sincerely appreciate it if you would educate yourself before implying that other people are incompetent in the future.

dllthomas 13y ago
"As it relates to the physical implementation of a network, part of the implementation includes configuring the devices." Arguable, but then what makes keys and passwords "not a part of the implementation"? "You seem to have an issue with me using the SSID as an example because its so easy to defeat that it would be a waste of time to even try." That is not my objection. I object to SSID as example of "security through obscurity" because I think it doesn't get at the core of what's wrong with security through obscurity and it has other far more glaring issues - so someone can fully grok that keeping SSID secret is not worthwhile and see "why" but without that "why" generalizing to (say) the company saying "We use our own proprietary cryptosystem. We can't show anyone the algorithm; it's more secure that way!" "In short, its not an example I made up on my own formed from a lack of understanding security, its an example that's used in textbooks and security-specific certification study guides." I wasn't questioning your understanding because you picked the example, but because you seem to persist in conflating things that seem clearly (and meaningfully) distinct. If textbooks and security-specific certification study guides use SSID as a canonical example of security through obscurity, I'm more worried not less.
- phaus 13y ago
  >Arguable, but then what makes keys and passwords "not a part of the implementation"? They are part of the implementation of a network, but the issues involving passwords and cryptographic keys are so complex that they generally aren't lumped into a conversation about security through obscurity. I made the statement in response to your claim that someone obtaining your SSH key would render SSH an example of security through obscurity, if my definition and the author's definition were used. With that line of thinking, the entire cryptography industry is merely security through obscurity and we should just give up. In practice, cryptographic technologies aren't considered to be security through obscurity unless the technologies are provably broken to a point where only an idiot would rely on them (such as WEP or LANMAN). As a caveat to this, when a cryptographic algorithm is hidden from the public in order to remain unbroken, it does become an example of security through obscurity. I just object to the idea that this is the only meaning to the phrase. > I object to SSID as example of "security through obscurity" because I think it doesn't get at the core of what's wrong with security through obscurity and it has other far more glaring issues - so someone can fully grok that keeping SSID secret is not worthwhile and see "why" but without that "why" generalizing to (say) the company saying "We use our own proprietary cryptosystem. We can't show anyone the algorithm; it's more secure that way!" The issue we began with was that you stated that it was not an example of security through obscurity at all. That was an incorrect statement and it still is. If you now want to argue that its not the best example, I would agree with you. As an introductory example it does a good job of explaining the concept to a layperson or even a technical person that's still a bit inexperienced. Could you find a better example to give to a room full of newbies? Probably, but that wasn't the issue we disagreed on. Its also important to note, that in a room full of security experts, you would be able to delve into the more complex aspects of the issue without losing the audience, so of course the example would be different.

by phaus 13y ago

dllthomas 13y ago

"As it relates to the physical implementation of a network, part of the implementation includes configuring the devices." Arguable, but then what makes keys and passwords "not a part of the implementation"? "You seem to have an issue with me using the SSID as an example because its so easy to defeat that it would be a waste of time to even try." That is not my objection. I object to SSID as example of "security through obscurity" because I think it doesn't get at the core of what's wrong with security through obscurity and it has other far more glaring issues - so someone can fully grok that keeping SSID secret is not worthwhile and see "why" but without that "why" generalizing to (say) the company saying "We use our own proprietary cryptosystem. We can't show anyone the algorithm; it's more secure that way!" "In short, its not an example I made up on my own formed from a lack of understanding security, its an example that's used in textbooks and security-specific certification study guides." I wasn't questioning your understanding because you picked the example, but because you seem to persist in conflating things that seem clearly (and meaningfully) distinct. If textbooks and security-specific certification study guides use SSID as a canonical example of security through obscurity, I'm more worried not less.

phaus 13y ago
>Arguable, but then what makes keys and passwords "not a part of the implementation"? They are part of the implementation of a network, but the issues involving passwords and cryptographic keys are so complex that they generally aren't lumped into a conversation about security through obscurity. I made the statement in response to your claim that someone obtaining your SSH key would render SSH an example of security through obscurity, if my definition and the author's definition were used. With that line of thinking, the entire cryptography industry is merely security through obscurity and we should just give up. In practice, cryptographic technologies aren't considered to be security through obscurity unless the technologies are provably broken to a point where only an idiot would rely on them (such as WEP or LANMAN). As a caveat to this, when a cryptographic algorithm is hidden from the public in order to remain unbroken, it does become an example of security through obscurity. I just object to the idea that this is the only meaning to the phrase. > I object to SSID as example of "security through obscurity" because I think it doesn't get at the core of what's wrong with security through obscurity and it has other far more glaring issues - so someone can fully grok that keeping SSID secret is not worthwhile and see "why" but without that "why" generalizing to (say) the company saying "We use our own proprietary cryptosystem. We can't show anyone the algorithm; it's more secure that way!" The issue we began with was that you stated that it was not an example of security through obscurity at all. That was an incorrect statement and it still is. If you now want to argue that its not the best example, I would agree with you. As an introductory example it does a good job of explaining the concept to a layperson or even a technical person that's still a bit inexperienced. Could you find a better example to give to a room full of newbies? Probably, but that wasn't the issue we disagreed on. Its also important to note, that in a room full of security experts, you would be able to delve into the more complex aspects of the issue without losing the audience, so of course the example would be different.