5 ms·

1. Security by obscurity 2. Security by obscurity

by antsar 12y ago

zAy0LfpBZLC8mAC 12y ago
Also, the distinction is largely pointless - vulnerabilities are not limited to some magic "security enforcing functions", so if the argument had any value, you'd have to keep all of the code secret. The security of a system tends to depend on all of the code that is in some way reachable from the outside. Also, they list antivirus software as a security measure - all the more reason to publish it all so people with some actual expertise in IT security can have a look at it.
- riskable 12y ago
  Not only that but the expectation that you can keep your AV vendor a secret is ridiculous. Especially with tens of thousands of employees having a system tray icon in direct view and hundreds to thousands of techs expected to be able to install/re-install said software. Not to mention the fact that big contracts with AV/security vendors are usually public knowledge and easily accessible. Heck, they probably have press releases indexed by Duck Duck Go!
SnacksOnAPlane 12y ago
Security by obscurity works. I don't know why so many people think it doesn't. If you don't have the source code to something, you have to poke around rather blindly to try to find holes. If you DO have the source code, you can analyze it and find holes in a targeted and specific manner. I understand the argument that you want to show your code to smart people so you can proactively find and fix holes in it, but that's not always feasible or smart.
- krisdol 12y ago
  Attackers have a mountain of tools and attack vectors available to them and they're going to try those first even if they have the source code. Also, when has security through obscurity actually worked? I hear the occasional blogger and tweeter spout this to get some page clicks, but I tend to side with academia here.
snowwrestler 12y ago
All computer security relies on obscurity, because all computer code can be numerically represented, and numbers are not secret. TLS? SSH? They are considered "secure" because the numbers they use are really, really, really obscure. So obscure that it would take too long to find them through any kind of naive search, to be useful. Security is not binary, though. Anything that extends the naive search time extends the security. Even if hiding the source code only doubles the search time for an exploit, that's still an improvement. Where people get in trouble is by overestimating the time extension. For example, by assuming that secret code can never be exploited because it's secret. That's where the scorn for "security by obscurity" comes from. Not because obscurity is useless, but because the value of obscurity is so easily overestimated.
- zAy0LfpBZLC8mAC 12y ago
  Your definition of secrecy is missing the point. By your definition, nothing can be secret, as anything can be represented as numbers. Secrecy comes from not knowing which number is the correct one, not from not being able to construct the number in principle. The useful distinction that is usually made between secrecy and obscurity hinges essentially on how easy it is to swap out the thing that's unknown to the attacker that security depends on. If your crypto key leaks, you generate a new one, and you are secure again, which is why the crypto key is a secret. If your source code leaks, no such thing, which is why hiding it is obscurity.

1. Security by obscurity 2. Security by obscurity

by antsar 12y ago

1. Security by obscurity 2. Security by obscurity

Also, the distinction is largely pointless - vulnerabilities are not limited to some magic "security enforcing functions", so if the argument had any value, you'd have to keep all of the code secret. The security of a system tends to depend on all of the code that is in some way reachable from the outside. Also, they list antivirus software as a security measure - all the more reason to publish it all so people with some actual expertise in IT security can have a look at it.

riskable 12y ago
Not only that but the expectation that you can keep your AV vendor a secret is ridiculous. Especially with tens of thousands of employees having a system tray icon in direct view and hundreds to thousands of techs expected to be able to install/re-install said software. Not to mention the fact that big contracts with AV/security vendors are usually public knowledge and easily accessible. Heck, they probably have press releases indexed by Duck Duck Go!

SnacksOnAPlane 12y ago

Security by obscurity works. I don't know why so many people think it doesn't. If you don't have the source code to something, you have to poke around rather blindly to try to find holes. If you DO have the source code, you can analyze it and find holes in a targeted and specific manner. I understand the argument that you want to show your code to smart people so you can proactively find and fix holes in it, but that's not always feasible or smart.

krisdol 12y ago
Attackers have a mountain of tools and attack vectors available to them and they're going to try those first even if they have the source code. Also, when has security through obscurity actually worked? I hear the occasional blogger and tweeter spout this to get some page clicks, but I tend to side with academia here.

snowwrestler 12y ago

All computer security relies on obscurity, because all computer code can be numerically represented, and numbers are not secret. TLS? SSH? They are considered "secure" because the numbers they use are really, really, really obscure. So obscure that it would take too long to find them through any kind of naive search, to be useful. Security is not binary, though. Anything that extends the naive search time extends the security. Even if hiding the source code only doubles the search time for an exploit, that's still an improvement. Where people get in trouble is by overestimating the time extension. For example, by assuming that secret code can never be exploited because it's secret. That's where the scorn for "security by obscurity" comes from. Not because obscurity is useless, but because the value of obscurity is so easily overestimated.

zAy0LfpBZLC8mAC 12y ago
Your definition of secrecy is missing the point. By your definition, nothing can be secret, as anything can be represented as numbers. Secrecy comes from not knowing which number is the correct one, not from not being able to construct the number in principle. The useful distinction that is usually made between secrecy and obscurity hinges essentially on how easy it is to swap out the thing that's unknown to the attacker that security depends on. If your crypto key leaks, you generate a new one, and you are secure again, which is why the crypto key is a secret. If your source code leaks, no such thing, which is why hiding it is obscurity.