4 ms·

Security through obscurity? No doubt a great deal would need to change, but we've tried the method of giving a select group of individuals an immense amount of

by woodman 12y ago

Security through obscurity? No doubt a great deal would need to change, but we've tried the method of giving a select group of individuals an immense amount of power and hoping for the best. It hasn't worked out that well. So I'd recommend that you consider the present situation, because the prospect of you knowing my tax information, by comparison, doesn't seem so bad.

navait 12y ago
If security through obscurity is having secrets at all, all security is obscurity.
- woodman 12y ago
  What is secret about a moat, electrified fence or a stated policy of mutual assured destruction?
  - navait 12y ago
    Heh, true. I've seen too much time thinking of computer security, and neglected to think of real world security.
  - AnthonyMouse 12y ago
    > What is secret about a moat, electrified fence or a stated policy of mutual assured destruction? Normal people don't have a moat. A major reason that e.g. home invasions are risky (and thus are deterred) is that the criminal doesn't know when the mark or the neighbors will be away from home, what security may be in place or whether there is anything worth stealing. If you put that information on the internet for anyone then every time you come home from work all your electronics will be missing. Replacing that "security through obscurity" with actual physical security is not something most people can afford.
    - woodman 12y ago
      What is more likely: I was suggesting that people secure their homes with a moat; or I was demonstrating that, contrary to the post I was responding to, not all security relies upon obscurity?
      - AnthonyMouse 12y ago
        And what good is physical security if you don't have it? If it doesn't exist in practice then pointing out that it exists in theory is just being pedantic.
        woodman 12y ago
        lol, ok buddy - being described as pedantic by a person who just helpfully volunteered the revelation that normal people don't have moats is just too weird.
      - JetSpiegel 12y ago
        Most people can't have moats, they don't live in detached houses. Apartments and high rises are much more common, moats don't work there.
joliv 12y ago
Interesting—I haven't seen that term used that way before. If I encrpyt my customers' private data using a well-publicized encryption method, is it still security through obscurity, simply because they are secrets?
- woodman 12y ago
  No. That would be like saying a locked door is security through obscurity, because the cuts of the key unlock the door - not the physical key. The concept requires a great deal of torturing to get there :) Anyway, the whole idea that the state needs to operate in secret to perform its duties is ridiculous and only serves bad actors. Who would seriously wish for a secret police force anyway? Maybe we should be focusing on preventing and deescalating, through systemic and scalable solutions, instead of masked weekend warriors kicking down doors and shooting people. Also, if you want a laugh - here is a funny story about what happens when you allow the DEA to operate in secret: http://www.thisamericanlife.org/radio-archives/episode/540/a-front http://www.thisamericanlife.org/radio-archives/episode/540/a...
  - derefr 12y ago
    > a locked door is security through obscurity, because the cuts of the key unlock the door - not the physical key. I don't know, that's not such a bad analogy. To put it another way, a key is just a really funny way to write down a bunch of numbers, and a key-lock is just a really esoteric number-pad. People have actually broken into houses by cutting working keys from pictures they took of victims unlocking their doors—so it's not even obscurity aiding the security per se (or rather, it used to be, but then we greatly standardized the way key-locks work.) Instead, it's just concealment, like the concealed face of a credit card in your wallet.
- derefr 12y ago
  If you keep the key on the same machine as the data, it might be the specific kind of "security through obscurity" that is more commonly referred to as "DRM."

by woodman 12y ago

navait 12y ago

If security through obscurity is having secrets at all, all security is obscurity.

woodman 12y ago
What is secret about a moat, electrified fence or a stated policy of mutual assured destruction?
- navait 12y ago
  Heh, true. I've seen too much time thinking of computer security, and neglected to think of real world security.
- AnthonyMouse 12y ago
  > What is secret about a moat, electrified fence or a stated policy of mutual assured destruction? Normal people don't have a moat. A major reason that e.g. home invasions are risky (and thus are deterred) is that the criminal doesn't know when the mark or the neighbors will be away from home, what security may be in place or whether there is anything worth stealing. If you put that information on the internet for anyone then every time you come home from work all your electronics will be missing. Replacing that "security through obscurity" with actual physical security is not something most people can afford.
  - woodman 12y ago
    What is more likely: I was suggesting that people secure their homes with a moat; or I was demonstrating that, contrary to the post I was responding to, not all security relies upon obscurity?
    - AnthonyMouse 12y ago
      And what good is physical security if you don't have it? If it doesn't exist in practice then pointing out that it exists in theory is just being pedantic.
      - woodman 12y ago
        lol, ok buddy - being described as pedantic by a person who just helpfully volunteered the revelation that normal people don't have moats is just too weird.
    - JetSpiegel 12y ago
      Most people can't have moats, they don't live in detached houses. Apartments and high rises are much more common, moats don't work there.

joliv 12y ago

Interesting—I haven't seen that term used that way before. If I encrpyt my customers' private data using a well-publicized encryption method, is it still security through obscurity, simply because they are secrets?

woodman 12y ago
No. That would be like saying a locked door is security through obscurity, because the cuts of the key unlock the door - not the physical key. The concept requires a great deal of torturing to get there :) Anyway, the whole idea that the state needs to operate in secret to perform its duties is ridiculous and only serves bad actors. Who would seriously wish for a secret police force anyway? Maybe we should be focusing on preventing and deescalating, through systemic and scalable solutions, instead of masked weekend warriors kicking down doors and shooting people. Also, if you want a laugh - here is a funny story about what happens when you allow the DEA to operate in secret: http://www.thisamericanlife.org/radio-archives/episode/540/a-front http://www.thisamericanlife.org/radio-archives/episode/540/a...
- derefr 12y ago
  > a locked door is security through obscurity, because the cuts of the key unlock the door - not the physical key. I don't know, that's not such a bad analogy. To put it another way, a key is just a really funny way to write down a bunch of numbers, and a key-lock is just a really esoteric number-pad. People have actually broken into houses by cutting working keys from pictures they took of victims unlocking their doors—so it's not even obscurity aiding the security per se (or rather, it used to be, but then we greatly standardized the way key-locks work.) Instead, it's just concealment, like the concealed face of a credit card in your wallet.
derefr 12y ago
If you keep the key on the same machine as the data, it might be the specific kind of "security through obscurity" that is more commonly referred to as "DRM."