9 ms·

Security through obscurity is not bad

207 points by mobeigi 5mo ago

Divs2890 4mo ago
[flagged]
catoc 5mo ago
“Security through obscurity” has the connotation that it is the obscurity that achieves the security - which is bad. ”Security including obscurity“ is fine.
- justonceokay 5mo ago
  Yes it’s not that it’s bad, it just means you aren’t done yet
- consumer451 5mo ago
  Yeah, I always thought that real security is priority #1. But, using convenient obscurity lowers the obvious attack surface to things like automated scanners, just a bit.
IlPeach 5mo ago
You mean "concealed flaws"?
Bender 5mo ago
Security through obscurity is NOT bad. Security ONLY through obscurity is bad (Kerckhoffs's Principle). Security through obscurity, as an additional layer, is good! I've been saying this ever since that phrase was coined. A layer or two of obscurity keeps a lot of noise out of logs, reduces alert fatigue and cuts down on storage costs especially if one is using Splunk as their SIEM and makes targeted attacks much easier to detect. I will keep it.
- mobeigi 5mo ago
  Couldn't agree more, I have personally benefited from the additional layer and it irks me when people outright claim it has no value.
  - ithkuil 5mo ago
    The informed claim is not that the obscurity layer has no value. Quite the contrary, it has such a great value that it basically reduces the incentives to have great proper security and thus once the obscurity layer is breached the second line of defense is weaker. The argument is that it's much easier to secure proper key material rather than design and config information that can often be leaked accidentally because it's actually directly manipulated by humans (employee onboarding, employee churn etc)
    - kstrauser 5mo ago
      That's an interesting way to describe it. It's kind of like the turn away from requiring regular password updates. On paper, password rotation is good. But when you consider its interaction with human psychology, the policy makes security worse by causing people to make bad decisions.
- rcleveng 5mo ago
  This sounds just like my thoughts on PostgreSQL's row level security. As a additional layer it's good, as the only thing, watch out!
- bee_rider 5mo ago
  It would be nice if there was no overlap between terms for the operational things that help improve security (log reduction and other non-cryptographic methods of reducing admin fatigue), and the mathematical cryptographic characteristics of the system. If the focus is on the latter, obscurity buys you nothing and adds complexity/distraction, which is bad. The former can be important though.
- tokai 5mo ago
  >I've been saying this ever since that phrase was coined You have been alive since the 1880s?
  - Barbing 5mo ago
    Smart talking your elders!
  - Bender 5mo ago
    1492 was the first time I experienced the quickening.
m3kw9 5mo ago
Obscurity should always be part of security
deleted 5mo ago
[deleted]
INTPenis 5mo ago
I've been saying for years, it's one layer of security. That's undeniable.
- Latty 5mo ago
  I'll push back on this: obscurity isn't a "free" layer of security, it has both security benefits and security costs. By having obscurity you lose anther layer of security: public scrutiny. It's harder for security issues to remain if people can see them and point them out, more eyes mean more chances to catch problems. There is also a cultural component: having to lay out what you are doing publicly means you can't just think "no one will know", and let something slide, which pushes you towards better security practices. Of course, this doesn't mean obscurity is always going to be the worse choice, there are times it will offer more than it costs and it's particularly evident that in, for example, open source projects, a lot of the time the number of eyes on most code is low enough that "many eyes" is a bit misleading, but I think presenting it as a pure positive is wrong, obscurity has cost, even if you think it's worth it in some cases.
  - INTPenis 5mo ago
    You're pushing back on something YOU said, not me. I never called it a "free" layer of security, I said it was ONE layer of security. Emphasizing the one, because security comes in as many layers as one is able to manage.
    - Latty 5mo ago
      Well, my issue is that "one layer" implies you can just stack it on others, especially if you say "as many layers as one is able to manage", it implies the best option is to add obscurity on top. As my comment made the case: it's not a simple addition, it's a trade-off, and I'm saying it should be thought about in those terms. I didn't find that was evident from what you said, I guess the "push back" framing was more negative than I intended.
      - INTPenis 5mo ago
fortran77 5mo ago
Wordpress is a great example. He cites > There is a long-standing security recommendation to change WordPress's default database table prefix to a random one. For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. I found that just changing the default URL for the wordpress login from the usual wp-admin to anything reduces by several orders of magnitude the number of scripts that try your site for the most common vulnerabilities---something that happens constantly for any site on the web, once a minute or so.
- pants2 5mo ago
  Nice. If you do the opposite of what WordPress does for security you're probably on the right track.
- i_think_so 5mo ago
  Same thing as changing your ssh port to something random. It's a trade-off with the convenience of knowing that all of your servers are listening on port 22 and you won't need any customizations in scripts or whatnot. But there are ways to mitigate much of that. On the benefit side, mitigating most of the computational load, log analysis load, how much are the baddies poking me while I sleep load, etc...all of these together make changing such defaults a slam dunk IMO.
- Fnoord 5mo ago
  Security through obscurity isn't security. It could be a method to reduce noise, but by doing so, you also have less eyes to watch over. If you'd pay for a blackbox pentest, and the pentester doesn't find your OpenSSH server running on a different port, then that doesn't tell you anything about the security of your OpenSSH server. In a whitebox pentest, they'd know about it beforehand. So, do you want to test the security of your OpenSSH server, yes or no? There's a very simple method to reduce spam in OpenSSH server logs: whitelist IPs of those who require access (could be ranges, too), and centralize over a jumphost. And something like Shodan (and friends) would find your OpenSSH server running on a different port anyway. But it wouldn't find it if you were using whitelisting of IPs of those who require access. There is, for example, no valid reason that people in China or Russia need to connect to your OpenSSH server. Why allow them to? Don't. I don't allow traffic from any IPs allocated to China or Russia, among a couple of other countries, and I don't feel like I am missing out. Another one is port knocking. Anyone who has read access over the network between client and server can figure out the port knocking process, including a hostile actor who does a MITM (with for example a rogue WiFi AP). So what happens is improper security (security through obscurity) means people don't apply real security measures (such as IP whitelisting). And that is why security through obscurity is bad. As for Wordpress, the default settings and default Wordpress is quite secure these days (have been this way for at least 10 years). It is all the bells and whistles in the form of addons which are the culprit.
thephyber 5mo ago
> Security ONLY through obscurity is bad (Kerckhoffs's Principle). This is the crux of the article. (1) Kerckhoffs's Principle doesn’t say that. It says to design the system AS IF the adversary has all of the info about it except the secrets (encryption key, certificates, etc). (2) this rule is okay if you are a solo maintainer of a WordPress installation. It’s a problem if you work at a large company and part of the company knows the full intent of this, while the rest of the company doesn’t know the other layers of security BECAUSE of the obscurity layer. In this way, it’s important to communicate that this is only a layer and shouldn’t replace any other security decisions.
- MattPalmer1086 5mo ago
  Kerkhoff's principle is not about security in general, it is about the design of cryptography. Assume your opponent knows everything about how your crypto system works. Your security then lies in the keys and not knowledge of the method. More broadly, anything that raises the cost of an attack helps security. Whether it is worth investing your defensive effort in that vs on more actual security is a different matter.
  - rileymat2 5mo ago
    If it does not obscure your own view of the security or reasoning about the security stance. For instance, with respect to url parameters, I have seen people being told they have an Insecure Direct Object Reference, then apply base64 encoding to it to obscure what is going on. To QA they don't notice it looks like junk, it is obscure, but base64 encoded parameters are catnip to hackers. So in this case, the obscurity made the system worse over time. Heck, the most cringeworthy phrase "Base64 Encryption" which I have heard many many times.
    - MattPalmer1086 5mo ago
      A nice point!
    - TZubiri 5mo ago
      I love this nuance! But I think it's covered by your immediate parent comment > Whether it is worth investing your defensive effort in that vs on more actual security is a different matter. So the base64 introduces a marginal security gain, but in addition to expending effort in implementation, it increases the cost of other efforts (which is the case for almost all features), in the case of a fixed cost QA (which is again, always the case), the quality of the QA (pardon the redundancy) will be the parameter that suffers. So yes, if the security gain is very minimal, then it's likely that the cost of the feature will be so great comparatively, that it will not only affect all other parameters like ease of use, but the negative indirect impact on security will be greater than the marginal positive direct impact on security. Many such cases.
caminante 5mo ago
Regarding Counterstrike (game) example, there were already a lot of cheaters and a cheater ecosystem that still exists to this day. I suspect Valve could address it if it wanted to, but the gameplay/development cost trade-offs aren't enough. Valve pivoted to server-side anti-cheat and toleration because someone probably did the math on max(profit) with lootboxes.
- mobeigi 5mo ago
  Valve's VACnet solution is definitely interesting. It uses AI, deep learning and is server side. It's hard to tell how effective that has been for them compared to traditional client side detection systems; I don't imagine they'll share any results. The fact that it's completely hidden from cheat developers gives them a huge advantage though. In the past, any client side algorithm or detection method could be reversed engineered by cheat developers and patched before lunch time. Now they're working against Valve completely in the dark.
  - deleted 5mo ago
    [deleted]
  - pona-a 5mo ago
    Which is a the power of not relying on obscurity. The server not sending you its complete source code is not any more obscure than a secret key. Security through obscurity is about obfuscating easy-to-recover trivia thinking it buys you any margin, like the client-side anti-cheat handing attackers everything they need to defeat it while trying to then obfuscate that code.
perching_aix 5mo ago
Cryptography is "just" a mathematically sophisticated version of manufacturing obscurity, so that's missing the point a bit. Obscurity is just information asymmetry, which is the only way we have to "secure" / anchor anything. That quote is about all the other forms of manufactured obscurity not being anywhere near as rigorous, which should be obvious.
- kortex 5mo ago
  Eh, the problem with that reasoning is one of extreme degree. The "obscurity metric" would be the surprisal associated with discovering the critical piece of info. Using a random port confers brute force resistance of 2^16. At 1ms that's about a minute. Brute forcing at the same rate a 128 bit key takes like 10^28 years. It's like hiding your key under the mat, vs hanging on a tree limb of a specific tree only you know the gps coordinate of. Both are "obscure". Huge difference in difficulty.
- jrmg 5mo ago
  Don’t like that you’re getting downvoted here! This is a pet peeve of mine. All security is ‘security through obscurity’ when you get right down to it. Cryptography is just a collection of ‘obscure’ keys (and, arguably, algorithms) that someone nefarious has to guess or work out - or social engineer out of someone - to access data. They’re just really hard to guess or work out.
  - eadwu 5mo ago
    Pet peeve of mine as well. To me this is a major problem of everyone saying security through obscurity is bad. But then those same people reinforcing encryption as a gospel of security. As far as I know, there are no secrets in the world. Encryption is not providing security to anything. It only gives you guarantees wrt to a certain interpretation/perspective. Modern encryption is underpinned by, no common folk (not no one or even the people who would have the ability to which are probably the ones that should be worried about) should be able to decrypt your contents _within your lifetime_ - which in and of itself is a pragmatic goal, but does not ensure secrets remain secrets.
AshamedCaptain 5mo ago
The problem with this argument is that you can justify an infinite amount of crap with it, the security equivalent of cockroach papers; which inevitably people ends up treating as real security. One example I remember is Pidgin storing its passwords in plain text in $HOME. They could have encrypted them with some hardcoded string, and made a lot of people happy that they would no longer grep their $HOME and find their passwords right there. However this had the side effect that now people were dropping the ball and sharing their config files with others. Or forgetting to setup proper permissions for their $HOME, etc. In addition, these layers of obscurity are also not overhead free: they may complicate debugging, hey may introduce dangerous dependencies, they may tie you to a vendor, they may reduce computing freedom (e.g. Secure Boot), etc.
- 2OEH8eoCRo0 5mo ago
  > The problem with this argument is that you can justify an infinite amount of crap with it Does that make it wrong?
  - dspillett 5mo ago
    Not per se. But it does make it potentially dangerous thinking depending on how it is applied.
  - HeavyStorm 5mo ago
    Yes
  - grayhatter 5mo ago
    If the model you're using tries to claim something that is false is actually true. Yes, your model is wrong.
- vlovich123 5mo ago
  Why a hardcoded string and not a user specific password the user used for pidgin? Then you’ve got real security and even using a password stored in the user’s keychain means that the passwords are not trivially accessible. The whole point of security in depth is that you use non colinear layers of protection to raise the cost of an attack and reduce the blast radius of a successful attack.
majorchord 5mo ago
Couldn't one argue that a password is also obscurity? It's only secure until someone figures it out, just like a secret URL on a website.
- exmadscientist 5mo ago
  Secret storage isn't considered "security through obscurity". Everyone knows that when you find the key to the door, you've won. Security through obscurity is more like hiding the keyhole: it isn't going to stop anyone determined, but it can be effective against someone who isn't all that motivated (well, all that motivated to target you, anyway).
  - Rury 5mo ago
    Which is a poor choice of words by the industry, as this is a semantically specious argument. You are still, in the strictest sense, relying on obscurity - the key being obscure from public knowledge. The industry should instead say: relying on an obscure process is bad when it comes to security. Better to rely on obscured data. As this is what is meant. But technically speaking, all of information security is done through obscurity. It is all done via hiding something from being known. To state otherwise, is a misuse of semantics.
CM30 5mo ago
Yeah, security through obscurity as part of securing a system is good. Security through obscurity as the only way of securing a system is not. Like, a lot of it comes down to 'high friction' vs 'low friction'. Obscurity means high friction. It means that the attacker needs to craft a specific solution for your site or system in particular rather than relying on an off-the-shelf solution to handle it all for them. For example, the article's point about changing the WordPress database prefix fits into this category perfectly. Does it really make things that much more 'secure'? No, of course not. But it does mean that automated scripts that just assume tables like wp_posts exist will fail. It means that an attacker can't just run any old WordPress hacking toolkit and watch it do its thing, they have to figure out what database prefix you're using first. Same with antispam solutions. The best solution to stop spam is to make your site unique in some way. To add some sort of challenge that a new user has to overcome to use the site, like a question related to the topic, a honeypot field they can't fill in, a script that detects how quickly they register, etc. This won't stop a determined spammer, but it will stop or delay bots and automated scripts that rely on the target system having the same behaviour across the board. The spammer has to specifically target your site in particular, not just every forum script running the same software. And much of society works this way to a degree. A federated or decentralised system (whether a social network or political movement) isn't technically harder to attack than a centralised one might be. But it is more work to attack it. If a government or company wants to censor Reddit or Discord or YouTube, they have one target they can force to censor information across the board. If they want to target the Fediverse or some sort of torrent based system, then they have to track down dozens of people and deal with at least some of those people refusing or taking it to court or being in countries that aren't under their control or whatever else. That's kinda what a good security through obscurity setup can be. You can't mass target everyone at once, you have to target different systems individually and spend more time and resources in the process. However, you still need real security measures there. Security through obscurity is like hiding a safe behind a painting. It'll stop casual attackers from finding it, but it won't stop a targeted attack on its own. You need a strong lock, materials that are difficult to drill through and the safe itself being difficult to remove from the wall too.
dwa3592 5mo ago
Security which has layers of obscurity can be incredibly powerful especially if you believe in counter intelligence. You want attackers to find the wrong key sometimes because it will lead to you collecting intelligence on them. But this increases the cost in time and infrastructure.
- i_think_so 5mo ago
  [dead]
- hunterpayne 5mo ago
  That isn't what the article is talking about. He is literally talking about running the JS code through an obfuscator and changing the default DB schema name. That isn't security and you know it.
linsomniac 5mo ago
I get what this post is saying, but I'm going to push back that "security through obscurity" isn't just something that people parrot without understanding. Obscurity provides, effectively, no security. There may be other benefits to the obscurity, but considering the obscurity a layer of your security is bad. I hope we all agree that moving telnet to another port provides no security (it's easily sniffable, easily fingerprintable). If it provides another benefit, use it, but don't think there's any security in it. For ~30 years I've moved my ssh to a non-standard port. It quiets down the logs nicely, people aren't always knocking on the door. But it's not a component of my security: I still disable password auth, disable root login, and only use ssh keys for access. But considering it security is undeniably bad.
- vlovich123 5mo ago
  If port numbers were 64bit or 128bit, actually it would provide a meaningful amount of security through obscurity. Port numbers are easy to dunk on because it’s such a trivially small search space.
  - sudb 5mo ago
    Similarly I've often flip-flopped on the safety of public API endpoints that are "protected" by virtue of no sitemap + UUIDs in the URL path - I think the answer ultimately is that this is fine so long as there's no way to enumerate the IDs in use?
    - vlovich123 5mo ago
      It’s fine as a hardening measure, not as a security measure. The lack of a site map doesn’t necessarily guarantee it doesn’t leak somehow and then the question is what happens after it leaks
  - i_think_so 5mo ago
    Good luck scanning 64k ports on a server that has a few randomly assigned fail2ban listeners.
josalhor 5mo ago
I want to add that Obscurity is ambiguous. Is changing the port of SSH "obscurity"? Some may say yes, because you could find it by bruteforce. But a password with infinite attempts can also be bruteforced. Here, the defining factor of security is maximum number of attempts (either on ports, username or whatever).
dspillett 5mo ago
Obscurity is not security. But it can add a bit of delay to someone breaking actual security, so maybe they'll hit the next target first as that is a touch easier. Though with the increasing automation of hole detection and exploitation, even that might stop being the case if it hasn't already. The biggest problem with obscurity measures IMO is psychological: people tend to assume that the measures⁰ are far more effective than they actually are, so they might make less effort to verify that the proper security is done properly. ---- [0] like moving SSHd to a non-standard port¹ [1] a solution that can inconvenience your users more than attackers, and historically (in combination with exploiting a couple of bugs) actually made certain local non-root credential scanning attacks possible if you chose a high port
- kbrkbr 5mo ago
  > Obscurity is not security. So ASLR [1] is not a security control? I guess you are pretty alone with this opinion. [1] https://en.wikipedia.org/wiki/Address_space_layout_randomization https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
  - msm_ 5mo ago
    No this is not what GP said, and I don't get how you reached this conclusion. This is like saying that AES is security through obscurity because it relies on key being secret. See [1] (linked in the OP) to understand the difference better. I am pretty sure everyone who works in security agrees that obscurity is not security. [1] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
    - deleted 5mo ago
      [deleted]
  - deleted 5mo ago
    [deleted]
  - minitech 5mo ago
    ASLR is (still[1]) not security by obscurity. [1] https://news.ycombinator.com/item?id=43408079 https://news.ycombinator.com/item?id=43408079
i_think_so 5mo ago
I have always replied to colleagues who poohpoohed "security through obscurity!" as if it was proof of ignorance or bad culture with "a password is just a string of obscure characters. ;-)" That's not a serious argument, of course. But consider how the spooks operate in the field. They employ all manner of obscure practices in an attempt to improve their security. Their intentional obscurity (AFAIK) is never allowed to unnecessarily complicate operational practices, which would introduce risk. And they've probably got a lot more theory and no-BS field testing behind their practices than we do. Maybe we should ask them for advice?
locallost 5mo ago
It's useless for the example given because obfuscating JavaScript as protection no longer has any purpose, if you can let AI analyze the code, and/or in this case the API requests. I recently did use a variation of this type of security to prevent a malicious user misusing our services... But I made a not to me an everyone else it was just a quick fix not guaranteed to work long term.
nobrains 5mo ago
My take: Do proper security, but if you are short on time or resources, you can start with security through obscurity, to block a few percentage of attacks, and then when you have time and resources, go ahead and add the proper security measures.
MagicMoonlight 5mo ago
Just because you have a bunker, doesn’t mean you hand the enemy the plans.
- rileymat2 5mo ago
  This presumes you have a working bunker and not a flawed one because you obscured the details from good actors that could identify problems.
dataflow 5mo ago
I could see AI massively changing the calculus here. Its ability to hack and reverse-engineer (even obfuscated) artifacts may leave obscurity (read: not sharing code or binaries at all) as the primary security mechanism in the industry.
- FrasiertheLion 5mo ago
  Yeah everything is open source if you’re good at reversing. Models are increasingly capable of converting binaries into source, and excellent at implementing systems when there’s a finite and constrained end state to validate against, which is exactly the profile reversing falls into.
FrasiertheLion 5mo ago
This was largely true before. But AI reduces the cost of comprehension and finding vulnerabilities en-masse to zero, so this no longer holds, and I’m increasingly convinced that hiding in noise and complexity is no longer a valid strategy. But AI symmetrically makes it easier to secure your system so it’s not like all hope is lost even if the transition period will be brutal. I wrote a blog about this: https://tanyaverma.sh/2026/03/01/nowhere-to-hide.html https://tanyaverma.sh/2026/03/01/nowhere-to-hide.html
some_random 5mo ago
Security through Obscurity used to work, with AI it absolutely does not.
rascul 5mo ago
Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.
- staticassertion 5mo ago
  I don't think that really works because obscurity isn't harder to see or find. I don't know the analogy, it's like standing out in the open and being like "yeah but who would think to look here lol".
  - willis936 5mo ago
    I think you're misinterpreting "obscurity" for "lack of obscurity". If you have a vulnerability in an API interface that is completely undocumented that is a vulnerability that is obscured. It's hiding in the woods, not standing in a field. To keep with the analogy: no one is going to stand in a field when people are shooting at you. So then why do a small subset of vocal people online suggest that you just put your bulletproof vest and claim that hiding in the woods, regardless of the vest, is a bad idea?
    - staticassertion 5mo ago
      This isn't about what's a good idea or bad idea. Perhaps it's best to simply leave analogies behind, otherwise we'll just focus on the wrong thing. Security through obscurity merely means that your system is atypical. It's not hidden, it's not secret, it's not hard to find, it's not hard to examine, it's not less visible, etc - there is nothing inherently different about the systems at all other than that one is more common than the other. It's just less typical.
      - willis936 5mo ago
        What you're describing is a thing that is not obscured. Don't refer to things as obscured if they are not obscured. When others talk about about things that are obscured they are talking about things that are obscured, not things that are not obscured.
shevy-java 5mo ago
Mo Beigi unfortunately misses the point. Yes, echo chambers are annoying - I remember this when I challenged them by explaining to me why being superuser is problematic (hint: I countered their arguments easily, then they got very angry about this; I did this on several IRC channels back in the day, just to prove a point. I managed to get banned on one too in the process.) But ... obscurity is NOT a security technique. It just has a catchy slogan. The primary reason why javascript is sometimes - or often - obfuscated is to make it harder to copy/paste and re-use stuff. That's it. Even with sanitizers, de-obfuscating it tends to increase the amount of time one has to spend to uncripple the code. This is the primary function; anything else is just decoy for the most part here. > Security through obscurity is the practice of reducing exposure by keeping an application's inner workings or implementation details less visible to attackers Very clearly his attempt to explain it, is already biased. Is obfuscating JavaScript security through obscurity? I mean if we can not agree to the terms, we can't agree or disagree on anything that follows. Showing fancy images does not add any real argument to the discussion. > For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. Note that this example does not even follow his own (!!!) definition. This has nothing to do with obscurity. It simply is another name than the default login name. What would he expect of people to do? Retain the name? And if they change it, are ALL changes in his opinion valid to "security through obscurity"? He picked wp_8df7b8_users here. Is the name "foobar" instead a better name? Or is it "not obscure enough"?
andix 5mo ago
If the obscurity it is only an additional layer on top of a secure system, it is called "defense in depth". It's a simple probability calculation. If some automated scanning tools can't find your service, a lot of attackers will never know of its existence. So even if it has an unpatched vulnerability, they won't attack it. If 1000 attackers find the vulnerable system, the probability is high at least one is attacking it. If it's only or two one who find it, they might just ignore your system, because they found thousands of others they randomly chose first.
jrnichols 5mo ago
I used to joke that we had "Security through Stupidity" - everything was so half-baked that no intruder would think we were being serious.
VerifiedReports 5mo ago
Reducing the attack volume seems like a good idea in any case. That's why forcing people to use E-mail addresses as user IDs is stupid.
Haven880 5mo ago
The problem with obscurity is that it breeds complacency; the implementer is often uninformed or assumes it protects everything else.
rolph 5mo ago
obscurity is a form of concealment, but not cover. concealment will make specific targeting -less than straightforward,but a scorched earth obliteration will get you along with all else. cover, is a condition that is resistant to attack when you are visible. you should have both, resistance to sequential action when you are specificly targeted, a obfusification of presence, minimizing the frequency of targeting.
0xbadcafebee 5mo ago
Security through obscurity is the same thing as security through praying. A stopped clock is right twice a day.
tkiolp4 5mo ago
The problem with security through obscurity (even if it’s just an “addon”) is that it pollutes your code base, system. It’s just not worth it. Like moving ssh to a different port. If you are the only one working on it, sure fine, as long as you remember the port. If you re working with others, then everyone needs to know the new port, so it has to be documented somehow. It’s a pita
glitchc 5mo ago
When a firewall rule blocks a port, is that security or obscurity?
tptacek 5mo ago
Everybody trying to discuss this gets the framing wrong. Obscurity isn't "bad" or "good". It's not "not" security. Security in the real-world sense is about risk. It fixes an adversary and then applies costs to them. Obscurity changes costs (usually by raising them for the adversary). Depending on the setting and the adversary, obscurity measures can raise costs by a material or immaterial amount. Obscurity measures usually also impose costs on defenders (and, transitively, on the intended users of the system). Those costs are different than they are for adversaries (usually: substantially lower). They might or might not be material. Your general goal is to asymmetrically raise costs on the adversary. Seen that way, it's usually pretty easy to reason about whether obscurity is worth pursuing or not. Don't do it if it doesn't materially raise costs for attackers, or, even if it does, if it doesn't raise costs way less for defenders and users. What trips people up in forums like this is that we're used to dealing with security problems framed in settings where we can impose \infty costs on attackers: foreclosing all known avenues of attack (to something like a mathematical certainty, and stipulating that computer science discoveries may change the cost function tomorrow). In those settings, all obscurity measures have relatively immaterial attacker costs associated. But it's still the same underlying problem! And, in the real world, we're actually rarely operating in model situations where we really can impose \infty costs on attackers.
e40 5mo ago
I remember when port knocking was discussed here on HN many years ago it was shit upon because people said security through obscurity is bad. What really frustrated me, at the time and still (when people shit on it), is that it's not just obscurity, it's also security. Port scans see nothing, but just knowing the port doesn't give you anything. You still need a password or key.
deleted 5mo ago
[deleted]
golem14 5mo ago
I am the Modern Man (Secret, secret, I've got a secret) Who hides behind a mask (Secret, secret, I've got a secret) So no one else can see (Secret, secret, I've got a secret) My true identity
daneel_w 5mo ago
Besides fangs and claws, a substantial amount of both predators and non-predators have highly evolved camouflage.
kk_mors 5mo ago
[flagged]
gnarlouse 5mo ago
If the Mythos era isn't just hype marketing, "sec-scurity" might not be a valid strategy anymore. If you're taking a beat because you're small and irrelevant, you could still be massively fucked over a breach. Mom & Pop code shops might be high risk if nation-state level vulnerability-exploitation becomes economically viable to any disgruntled prick.
keithnz 5mo ago
One thing I like about some layer of obscurity is not so much anyone directly attacking you, it's someone generically attacking you because you happened to use a common thing that someone finds a security hole with.
costco 5mo ago
reCAPTCHA is a great success story of security through obscurity because probably less than 100 people have reverse engineered it and much less than that have produced a working solver for it that doesn't require a headless browser. Snapchat would be another good example - almost no one is going to put in the work to understand this [0]. Most companies just half ass it though and accordingly achieve nothing with the obscurity at all besides worse performance. [0] https://web.archive.org/web/20201128060507/https://hot3eed.github.io/snap_part1_obfuscations.html https://web.archive.org/web/20201128060507/https://hot3eed.g...
ChrisMarshallNY 5mo ago
I don't think "obscurity" really buys you much (especially these days, with LLMs). However "Not Having Stuff to Steal" works like a charm. It's thousands of years old, and has never gone out of style. I know that it's considered blasphemy, hereabouts, but I've found that not collecting information that I don't absolutely need is pretty effective. Even if someone knocks down all my gates and fences, they'll find the fox wasn't worth the chase. It does make stuff like compiling metrics more of a pain, but that's my problem; not my users'.
- danparsonson 5mo ago
  That's fine if the goal of breaking in is immediate theft; it might also be more along the lines of leaving something behind.
  - ChrisMarshallNY 5mo ago
    Not sure if obscurity buys you anything, then. In that case, it's all about standard security practices.
- keeda 5mo ago
  Totally agreed, to me data is just like code: extremely valuable for the functionality it provides, but in most other ways a serious liability. That said: > I don't think "obscurity" really buys you much (especially these days, with LLMs). Actually I think it does so even more with LLMs. As has been posited before (particularly on the threads about open source projects going closed source) security comes down to who has paid more attention to the code, the attacker or the defender. And of course, these days attention is measured in tokens. We know that LLM's are pretty capable of reversing-engineering to figure out an application's logic, but I would bet it takes many more tokens than reading the code or other public information directly. As such, obscurity adds an important layer to security: increasing the costs on the attacker. Security has always been a numbers game, but now the numbers will overwhemingly be tokens and scale. If the defenders can cheaply raise the costs on the attackers by adding simple layers of obscurity, it can act as a significant deterrent at scale. I wonder if we'll even see new obfuscation techniques that are cheap to implement but targeted specifically at LLMs...
mazone 5mo ago
In a corporate setting my experience is that it is rarely worth it to add any obscurity on top of security. Your biggest challenge is getting peoples time and resources, and you need to use that time to implement security controls. A secondary objective you have is to build security culture over time and teach people too see patterns where more security is needed, so it is important to select what to teach to get maximum impact.
corvad 5mo ago
Security through obscurity is bad. Security AND obscurity is fine. There's a very clear distinction here.
EGreg 5mo ago
Kerchkoff would beg to disagree. Please do not refuse a beggar: https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
h4kunamata 5mo ago
It is bad! The way how human brain works, anything that gives you the slightly sense of "security", will make you to leave as it is without implementing an actual solution. That security by obscurity is now a security issue.
danpalmer 5mo ago
> For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. In some ways this is not security through obscurity. If you don't have a way to enumerate tables, this is in effect another short password being added to the data. In the same way you could say that the "obscurity" of users' passwords is security through obscurity... except we still use passwords. The idea of security through obscurity being bad stemmed from the idea that a cryptosystem should still be secure when you know how it works. That's all. In that way, you know how WordPress works, and yet you don't have access. You know how passwords work, and yet don't have access. Obfuscating code is interesting because it sort of sits between the two. You could execute the code, and you may know how the obfuscation scheme works, but you can't de-obfuscate easily and see the original intent, and that way it's useful. The fact that you can still execute the code does however limit the impact.
pbgcp2026 5mo ago
... perfect topic for Hacker news ...
OhMeadhbh 5mo ago
Saying anything about security without mentioning the nature of the threat is bad. It's also industry common practice. Obfuscating JS is probably a decent defence against your 9 year old brother. It is not against a motivated, well funded state sponsored attacker. Part of what bugs me about English is the practical ambiguity of the colloquial understanding of what "<foo> is <bar>" implies. Does it mean that all foos are also bars or does it mean there exists a foo where that foo is also bar? Does it mean foo is always bad or foo is often bar? Dutch is my first language and I grew up in South Viet Nam, Nigeria and Texas. I did not get the standard programming.
- srdjanr 5mo ago
  The author gave a few examples where compiled/minified code is public (Javascript and games) or automated vuln exploits (Wordpress example). That does explain nature of threat well enough for me. There's a whole spectrum between 9 year old and a motivated state actor, and obfuscation is effective for a big part of the spectrum.
  - OhMeadhbh 5mo ago
    I was talking about the click-baity title more than the content.
OhMeadhbh 5mo ago
And the second thing that bugs me about this interaction... Sure... "Security" is a process. It is a way of looking at things. It is proper use of tools and awareness of threat when designing software. But it is also a set of trade-offs and relationships between architectural components. It worries me that this isn't displayed in the interaction described in the post
maxrev17 5mo ago
The AI era shows we relied on it for decades in some big software anyway despite claiming it’s bad :p ahaha
high_na_euv 5mo ago
Wtf, why ppl struggle so hard with simple concept Obscurity increases the bar, and now, some actors will be prevented just by it, some delayed and some not affected at all, but after all you dont know who is attacking you and their skills!
- viccis 5mo ago
  It's just a good component of a defense in depth approach. Where it's bad is when it's the only defense. Putting a sensitive server behind port knocking will cut down on 99.99999% of random internet IPs spraying attacks at it, so it's worth doing. Just don't rely on it for the only auth check.
Havoc 5mo ago
Yeah people took a solid conceptual reminder and turned it into an absolute prohibition.
WesolyKubeczek 5mo ago
Security through obscurity is only bad when it’s the only measure used. If proper security is also in place, it is the cherry on top. For example, while I know that ssh bruteforcing bots won’t enter my server no matter how much they try, putting ssh on a non-standard port reduces the number of tries to zero.
ndc 5mo ago
Cixin Liu's Dark Forest theory is security through obscurity. If you don't have any other defense mechanism, at least try to hide.
ceving 5mo ago
Outch! Security is security. Obscurity is obscurity. Piety is piety. All three have nothing in common.
TZubiri 5mo ago
The source of this bias is voyeurism. It's always someone outside your org telling you that obscurity is bad, and that you should definitely publish all your source code to let them see. It's self serving outside judgment to get you to provide them value. On the other side of the coin, there is a bias towards this trope that comes from exhibitionism: those of us who hold that security through obscurity is valuable, will usually not publish our thoughts on other security mechanisms, since we will consider that doing so decreases our security, whereas those that believe in the trope, will publish all of their thoughts on security, as they do not depend on or value the secrecy of their strategies.
TZubiri 5mo ago
>For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. >My website was vulnerable. However, I was not impacted by any attacks, and I updated the plugin to a patched version a few days later. While other sites were "nulled" and destroyed, I was spared. I later found a PoC script on GitHub showcasing the exploitation. Using that PoC on my own site failed with a generic error like Table 'wordpress.wp_users' doesn't exist. The biological sciences fully support this form of protection. One of the main benefits of the whole of sexual reproduction is based on this principle. Mutations introduce diversity to populations which allows otherwise extinction events to just affect a fraction of the population. So yeah, maybe the university of Open Source internet considers your approach to security to be baseless, but (in addition to your empirical experience), security through obscurity is well recognized in zoology.
trashb 5mo ago
Security is the lock on the safe. Obscurity is the information you need to find the safe. All security can eventually be broken, given enough time, this is why A very useful measure for the security of a lock is how long it takes to break. The same is true for cryptography. Obscurity can add a buffer before you can start breaking the lock and it can act as a deterrent for opportunistic attacks. Additionally it can help with signal to noise and monitoring of the lock. This is why you have a lock on your front door and don't tell anyone you meet where exactly in your house you store your valuable jewels (preferably out of sight). You also want to monitor anyone in your garden more closely than on the road passing by.
- allknowingfrog 5mo ago
  Isn't it all just information? The lock code and the location of the safe are both just data. I think it's possible that all security is obscurity.
blamestross 5mo ago
I feel like nobody actually understands the real reason security through obscurity is so bad. It results in dead cryptographers. The implementor becomes the weakest link in the chain, and entities with a tolerance for violence can fix that problem.
grayhatter 5mo ago
> Security through obscurity, as an additional layer, is good! If and only if the security advantage it gives outweighs the the numerous disadvantages. It never* does. That's why the comment calling it bad got so many upvotes. Mixed in with those cargoculting the meme, are people like me who have had to deal with obfuscation techniques, written by someone else, that the bad guys understood before I did. Obfuscation as a security measure is bad, because it feels like it's positives can compete with it's negatives; but that's rarely the case. *: effectively never
- stavros 5mo ago
  > It never* does. Can you substantiate this claim a bit?
  - grayhatter 5mo ago
    > Can you substantiate this claim a bit? I might, depending on how much objective evidence you'd demand for substance. The problem with obscurity as a security feature, is the group(s) that feels the impact the most. Heuristically, you can create 3 groups that are impacted. APTs, skiddies, devs/maintainers. Obscurity will stop skiddies... effectively 100% ....but so will everything else. Regular updates, and a half good password also stops skiddies to effectively 100%. Obscurity has a net negative effect on the system because it doesn't increase the attack cost on skiddies, but does increase the maintenance cost to engineering. This is the vast majority of attackers you'd want to deal with. Your Advanced Persistent Threats, will be slowed by some amount of obscurity, but they will not be be stopped by it at all, at best it's a road bump. Persistence and intent will overcome any amount of obscurity. Same idea as give enough eyes, all bugs are shallow. Given enough time, any/all amount of obscurity will be understood by the baddies. The downsides to obscurity is it's cost both to maintenance of the system as a whole, but also to the heuristics non-security developers use to find/understand bugs. Obscurity introduces significant complexity into the system. That complexity makes it harder to find and understand real bugs, but worse, it also obscures the security of the system itself to non-experts. I do believe we'll never escape the reality that most developers see obscurity, and think "this 'secret' makes this secure" but obscurity is *not* a secret. It doesn't provide additional security/safety. It only marginally increases the time to find and deploy the exploit. Here, this extra layer of obscurity actually decreases security because developers will stop looking for ways to harden the system, because this "secret" is good enough. I.e. the obscurity added only has the opportunity cost replacing the effort that would have been spent on real security. If you have a full security team managing the obscurity the maintenance cost to the system, will be less than the cost to your APTs, but if you don't have a full time team working on it (or at least a strong expert in both how obscurity benefits the system, but more important, a strong expert in real security), the maintenance costs will exceed the time/delay until exploitation. It's likely that I could deploy some system securely, with obscurity layered over top. But I often don't because I don't wanna deal with it. It makes debugging harder. Depending on what specific flavor, it might also give the baddies a place to hide, because the signal of attacks no longer looks like the signal everyone expects. If you can avoid *ALL* of the pitfalls. It will, without a doubt, increase the time to exploit. The problem being, if you're unable to avoid all the pitfalls of it, the negative aspects will have a much stronger cost and influence on the maintenance of the system, and the devs, contrasted with the cost it might have on any attack.
morpheos137 5mo ago
prime number based encryption is litterally security through obscurity at scale. nature knows no other way to secure information besides hashing, physical barriers or distance or time or noise barriers.

207 points by mobeigi 5mo ago

[flagged]

catoc 5mo ago

“Security through obscurity” has the connotation that it is the obscurity that achieves the security - which is bad. ”Security including obscurity“ is fine.

justonceokay 5mo ago
Yes it’s not that it’s bad, it just means you aren’t done yet
consumer451 5mo ago
Yeah, I always thought that real security is priority #1. But, using convenient obscurity lowers the obvious attack surface to things like automated scanners, just a bit.

IlPeach 5mo ago

You mean "concealed flaws"?

Bender 5mo ago

Security through obscurity is NOT bad. Security ONLY through obscurity is bad (Kerckhoffs's Principle). Security through obscurity, as an additional layer, is good! I've been saying this ever since that phrase was coined. A layer or two of obscurity keeps a lot of noise out of logs, reduces alert fatigue and cuts down on storage costs especially if one is using Splunk as their SIEM and makes targeted attacks much easier to detect. I will keep it.

mobeigi 5mo ago
Couldn't agree more, I have personally benefited from the additional layer and it irks me when people outright claim it has no value.
- ithkuil 5mo ago
  The informed claim is not that the obscurity layer has no value. Quite the contrary, it has such a great value that it basically reduces the incentives to have great proper security and thus once the obscurity layer is breached the second line of defense is weaker. The argument is that it's much easier to secure proper key material rather than design and config information that can often be leaked accidentally because it's actually directly manipulated by humans (employee onboarding, employee churn etc)
  - kstrauser 5mo ago
    That's an interesting way to describe it. It's kind of like the turn away from requiring regular password updates. On paper, password rotation is good. But when you consider its interaction with human psychology, the policy makes security worse by causing people to make bad decisions.
rcleveng 5mo ago
This sounds just like my thoughts on PostgreSQL's row level security. As a additional layer it's good, as the only thing, watch out!
bee_rider 5mo ago
It would be nice if there was no overlap between terms for the operational things that help improve security (log reduction and other non-cryptographic methods of reducing admin fatigue), and the mathematical cryptographic characteristics of the system. If the focus is on the latter, obscurity buys you nothing and adds complexity/distraction, which is bad. The former can be important though.
tokai 5mo ago
>I've been saying this ever since that phrase was coined You have been alive since the 1880s?
- Barbing 5mo ago
  Smart talking your elders!
- Bender 5mo ago
  1492 was the first time I experienced the quickening.

m3kw9 5mo ago

Obscurity should always be part of security

deleted 5mo ago

[deleted]

INTPenis 5mo ago

I've been saying for years, it's one layer of security. That's undeniable.

Latty 5mo ago
I'll push back on this: obscurity isn't a "free" layer of security, it has both security benefits and security costs. By having obscurity you lose anther layer of security: public scrutiny. It's harder for security issues to remain if people can see them and point them out, more eyes mean more chances to catch problems. There is also a cultural component: having to lay out what you are doing publicly means you can't just think "no one will know", and let something slide, which pushes you towards better security practices. Of course, this doesn't mean obscurity is always going to be the worse choice, there are times it will offer more than it costs and it's particularly evident that in, for example, open source projects, a lot of the time the number of eyes on most code is low enough that "many eyes" is a bit misleading, but I think presenting it as a pure positive is wrong, obscurity has cost, even if you think it's worth it in some cases.
- INTPenis 5mo ago
  You're pushing back on something YOU said, not me. I never called it a "free" layer of security, I said it was ONE layer of security. Emphasizing the one, because security comes in as many layers as one is able to manage.
  - Latty 5mo ago
    Well, my issue is that "one layer" implies you can just stack it on others, especially if you say "as many layers as one is able to manage", it implies the best option is to add obscurity on top. As my comment made the case: it's not a simple addition, it's a trade-off, and I'm saying it should be thought about in those terms. I didn't find that was evident from what you said, I guess the "push back" framing was more negative than I intended.
    - INTPenis 5mo ago

fortran77 5mo ago

Wordpress is a great example. He cites > There is a long-standing security recommendation to change WordPress's default database table prefix to a random one. For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. I found that just changing the default URL for the wordpress login from the usual wp-admin to anything reduces by several orders of magnitude the number of scripts that try your site for the most common vulnerabilities---something that happens constantly for any site on the web, once a minute or so.

pants2 5mo ago
Nice. If you do the opposite of what WordPress does for security you're probably on the right track.
i_think_so 5mo ago
Same thing as changing your ssh port to something random. It's a trade-off with the convenience of knowing that all of your servers are listening on port 22 and you won't need any customizations in scripts or whatnot. But there are ways to mitigate much of that. On the benefit side, mitigating most of the computational load, log analysis load, how much are the baddies poking me while I sleep load, etc...all of these together make changing such defaults a slam dunk IMO.
Fnoord 5mo ago
Security through obscurity isn't security. It could be a method to reduce noise, but by doing so, you also have less eyes to watch over. If you'd pay for a blackbox pentest, and the pentester doesn't find your OpenSSH server running on a different port, then that doesn't tell you anything about the security of your OpenSSH server. In a whitebox pentest, they'd know about it beforehand. So, do you want to test the security of your OpenSSH server, yes or no? There's a very simple method to reduce spam in OpenSSH server logs: whitelist IPs of those who require access (could be ranges, too), and centralize over a jumphost. And something like Shodan (and friends) would find your OpenSSH server running on a different port anyway. But it wouldn't find it if you were using whitelisting of IPs of those who require access. There is, for example, no valid reason that people in China or Russia need to connect to your OpenSSH server. Why allow them to? Don't. I don't allow traffic from any IPs allocated to China or Russia, among a couple of other countries, and I don't feel like I am missing out. Another one is port knocking. Anyone who has read access over the network between client and server can figure out the port knocking process, including a hostile actor who does a MITM (with for example a rogue WiFi AP). So what happens is improper security (security through obscurity) means people don't apply real security measures (such as IP whitelisting). And that is why security through obscurity is bad. As for Wordpress, the default settings and default Wordpress is quite secure these days (have been this way for at least 10 years). It is all the bells and whistles in the form of addons which are the culprit.

thephyber 5mo ago

> Security ONLY through obscurity is bad (Kerckhoffs's Principle). This is the crux of the article. (1) Kerckhoffs's Principle doesn’t say that. It says to design the system AS IF the adversary has all of the info about it except the secrets (encryption key, certificates, etc). (2) this rule is okay if you are a solo maintainer of a WordPress installation. It’s a problem if you work at a large company and part of the company knows the full intent of this, while the rest of the company doesn’t know the other layers of security BECAUSE of the obscurity layer. In this way, it’s important to communicate that this is only a layer and shouldn’t replace any other security decisions.

MattPalmer1086 5mo ago
Kerkhoff's principle is not about security in general, it is about the design of cryptography. Assume your opponent knows everything about how your crypto system works. Your security then lies in the keys and not knowledge of the method. More broadly, anything that raises the cost of an attack helps security. Whether it is worth investing your defensive effort in that vs on more actual security is a different matter.
- rileymat2 5mo ago
  If it does not obscure your own view of the security or reasoning about the security stance. For instance, with respect to url parameters, I have seen people being told they have an Insecure Direct Object Reference, then apply base64 encoding to it to obscure what is going on. To QA they don't notice it looks like junk, it is obscure, but base64 encoded parameters are catnip to hackers. So in this case, the obscurity made the system worse over time. Heck, the most cringeworthy phrase "Base64 Encryption" which I have heard many many times.
  - MattPalmer1086 5mo ago
    A nice point!
  - TZubiri 5mo ago
    I love this nuance! But I think it's covered by your immediate parent comment > Whether it is worth investing your defensive effort in that vs on more actual security is a different matter. So the base64 introduces a marginal security gain, but in addition to expending effort in implementation, it increases the cost of other efforts (which is the case for almost all features), in the case of a fixed cost QA (which is again, always the case), the quality of the QA (pardon the redundancy) will be the parameter that suffers. So yes, if the security gain is very minimal, then it's likely that the cost of the feature will be so great comparatively, that it will not only affect all other parameters like ease of use, but the negative indirect impact on security will be greater than the marginal positive direct impact on security. Many such cases.

caminante 5mo ago

Regarding Counterstrike (game) example, there were already a lot of cheaters and a cheater ecosystem that still exists to this day. I suspect Valve could address it if it wanted to, but the gameplay/development cost trade-offs aren't enough. Valve pivoted to server-side anti-cheat and toleration because someone probably did the math on max(profit) with lootboxes.

mobeigi 5mo ago
Valve's VACnet solution is definitely interesting. It uses AI, deep learning and is server side. It's hard to tell how effective that has been for them compared to traditional client side detection systems; I don't imagine they'll share any results. The fact that it's completely hidden from cheat developers gives them a huge advantage though. In the past, any client side algorithm or detection method could be reversed engineered by cheat developers and patched before lunch time. Now they're working against Valve completely in the dark.
- deleted 5mo ago
  [deleted]
- pona-a 5mo ago
  Which is a the power of not relying on obscurity. The server not sending you its complete source code is not any more obscure than a secret key. Security through obscurity is about obfuscating easy-to-recover trivia thinking it buys you any margin, like the client-side anti-cheat handing attackers everything they need to defeat it while trying to then obfuscate that code.

perching_aix 5mo ago

Cryptography is "just" a mathematically sophisticated version of manufacturing obscurity, so that's missing the point a bit. Obscurity is just information asymmetry, which is the only way we have to "secure" / anchor anything. That quote is about all the other forms of manufactured obscurity not being anywhere near as rigorous, which should be obvious.

kortex 5mo ago
Eh, the problem with that reasoning is one of extreme degree. The "obscurity metric" would be the surprisal associated with discovering the critical piece of info. Using a random port confers brute force resistance of 2^16. At 1ms that's about a minute. Brute forcing at the same rate a 128 bit key takes like 10^28 years. It's like hiding your key under the mat, vs hanging on a tree limb of a specific tree only you know the gps coordinate of. Both are "obscure". Huge difference in difficulty.
jrmg 5mo ago
Don’t like that you’re getting downvoted here! This is a pet peeve of mine. All security is ‘security through obscurity’ when you get right down to it. Cryptography is just a collection of ‘obscure’ keys (and, arguably, algorithms) that someone nefarious has to guess or work out - or social engineer out of someone - to access data. They’re just really hard to guess or work out.
- eadwu 5mo ago
  Pet peeve of mine as well. To me this is a major problem of everyone saying security through obscurity is bad. But then those same people reinforcing encryption as a gospel of security. As far as I know, there are no secrets in the world. Encryption is not providing security to anything. It only gives you guarantees wrt to a certain interpretation/perspective. Modern encryption is underpinned by, no common folk (not no one or even the people who would have the ability to which are probably the ones that should be worried about) should be able to decrypt your contents _within your lifetime_ - which in and of itself is a pragmatic goal, but does not ensure secrets remain secrets.

AshamedCaptain 5mo ago

The problem with this argument is that you can justify an infinite amount of crap with it, the security equivalent of cockroach papers; which inevitably people ends up treating as real security. One example I remember is Pidgin storing its passwords in plain text in $HOME. They could have encrypted them with some hardcoded string, and made a lot of people happy that they would no longer grep their $HOME and find their passwords right there. However this had the side effect that now people were dropping the ball and sharing their config files with others. Or forgetting to setup proper permissions for their $HOME, etc. In addition, these layers of obscurity are also not overhead free: they may complicate debugging, hey may introduce dangerous dependencies, they may tie you to a vendor, they may reduce computing freedom (e.g. Secure Boot), etc.

2OEH8eoCRo0 5mo ago
> The problem with this argument is that you can justify an infinite amount of crap with it Does that make it wrong?
- dspillett 5mo ago
  Not per se. But it does make it potentially dangerous thinking depending on how it is applied.
- HeavyStorm 5mo ago
  Yes
- grayhatter 5mo ago
  If the model you're using tries to claim something that is false is actually true. Yes, your model is wrong.
vlovich123 5mo ago
Why a hardcoded string and not a user specific password the user used for pidgin? Then you’ve got real security and even using a password stored in the user’s keychain means that the passwords are not trivially accessible. The whole point of security in depth is that you use non colinear layers of protection to raise the cost of an attack and reduce the blast radius of a successful attack.

majorchord 5mo ago

Couldn't one argue that a password is also obscurity? It's only secure until someone figures it out, just like a secret URL on a website.

exmadscientist 5mo ago
Secret storage isn't considered "security through obscurity". Everyone knows that when you find the key to the door, you've won. Security through obscurity is more like hiding the keyhole: it isn't going to stop anyone determined, but it can be effective against someone who isn't all that motivated (well, all that motivated to target you, anyway).
- Rury 5mo ago
  Which is a poor choice of words by the industry, as this is a semantically specious argument. You are still, in the strictest sense, relying on obscurity - the key being obscure from public knowledge. The industry should instead say: relying on an obscure process is bad when it comes to security. Better to rely on obscured data. As this is what is meant. But technically speaking, all of information security is done through obscurity. It is all done via hiding something from being known. To state otherwise, is a misuse of semantics.

CM30 5mo ago

Yeah, security through obscurity as part of securing a system is good. Security through obscurity as the only way of securing a system is not. Like, a lot of it comes down to 'high friction' vs 'low friction'. Obscurity means high friction. It means that the attacker needs to craft a specific solution for your site or system in particular rather than relying on an off-the-shelf solution to handle it all for them. For example, the article's point about changing the WordPress database prefix fits into this category perfectly. Does it really make things that much more 'secure'? No, of course not. But it does mean that automated scripts that just assume tables like wp_posts exist will fail. It means that an attacker can't just run any old WordPress hacking toolkit and watch it do its thing, they have to figure out what database prefix you're using first. Same with antispam solutions. The best solution to stop spam is to make your site unique in some way. To add some sort of challenge that a new user has to overcome to use the site, like a question related to the topic, a honeypot field they can't fill in, a script that detects how quickly they register, etc. This won't stop a determined spammer, but it will stop or delay bots and automated scripts that rely on the target system having the same behaviour across the board. The spammer has to specifically target your site in particular, not just every forum script running the same software. And much of society works this way to a degree. A federated or decentralised system (whether a social network or political movement) isn't technically harder to attack than a centralised one might be. But it is more work to attack it. If a government or company wants to censor Reddit or Discord or YouTube, they have one target they can force to censor information across the board. If they want to target the Fediverse or some sort of torrent based system, then they have to track down dozens of people and deal with at least some of those people refusing or taking it to court or being in countries that aren't under their control or whatever else. That's kinda what a good security through obscurity setup can be. You can't mass target everyone at once, you have to target different systems individually and spend more time and resources in the process. However, you still need real security measures there. Security through obscurity is like hiding a safe behind a painting. It'll stop casual attackers from finding it, but it won't stop a targeted attack on its own. You need a strong lock, materials that are difficult to drill through and the safe itself being difficult to remove from the wall too.

dwa3592 5mo ago

Security which has layers of obscurity can be incredibly powerful especially if you believe in counter intelligence. You want attackers to find the wrong key sometimes because it will lead to you collecting intelligence on them. But this increases the cost in time and infrastructure.

i_think_so 5mo ago
[dead]
hunterpayne 5mo ago
That isn't what the article is talking about. He is literally talking about running the JS code through an obfuscator and changing the default DB schema name. That isn't security and you know it.

linsomniac 5mo ago

I get what this post is saying, but I'm going to push back that "security through obscurity" isn't just something that people parrot without understanding. Obscurity provides, effectively, no security. There may be other benefits to the obscurity, but considering the obscurity a layer of your security is bad. I hope we all agree that moving telnet to another port provides no security (it's easily sniffable, easily fingerprintable). If it provides another benefit, use it, but don't think there's any security in it. For ~30 years I've moved my ssh to a non-standard port. It quiets down the logs nicely, people aren't always knocking on the door. But it's not a component of my security: I still disable password auth, disable root login, and only use ssh keys for access. But considering it security is undeniably bad.

vlovich123 5mo ago
If port numbers were 64bit or 128bit, actually it would provide a meaningful amount of security through obscurity. Port numbers are easy to dunk on because it’s such a trivially small search space.
- sudb 5mo ago
  Similarly I've often flip-flopped on the safety of public API endpoints that are "protected" by virtue of no sitemap + UUIDs in the URL path - I think the answer ultimately is that this is fine so long as there's no way to enumerate the IDs in use?
  - vlovich123 5mo ago
    It’s fine as a hardening measure, not as a security measure. The lack of a site map doesn’t necessarily guarantee it doesn’t leak somehow and then the question is what happens after it leaks
- i_think_so 5mo ago
  Good luck scanning 64k ports on a server that has a few randomly assigned fail2ban listeners.

josalhor 5mo ago

I want to add that Obscurity is ambiguous. Is changing the port of SSH "obscurity"? Some may say yes, because you could find it by bruteforce. But a password with infinite attempts can also be bruteforced. Here, the defining factor of security is maximum number of attempts (either on ports, username or whatever).

dspillett 5mo ago

Obscurity is not security. But it can add a bit of delay to someone breaking actual security, so maybe they'll hit the next target first as that is a touch easier. Though with the increasing automation of hole detection and exploitation, even that might stop being the case if it hasn't already. The biggest problem with obscurity measures IMO is psychological: people tend to assume that the measures⁰ are far more effective than they actually are, so they might make less effort to verify that the proper security is done properly. ---- [0] like moving SSHd to a non-standard port¹ [1] a solution that can inconvenience your users more than attackers, and historically (in combination with exploiting a couple of bugs) actually made certain local non-root credential scanning attacks possible if you chose a high port

kbrkbr 5mo ago
> Obscurity is not security. So ASLR [1] is not a security control? I guess you are pretty alone with this opinion. [1] https://en.wikipedia.org/wiki/Address_space_layout_randomization https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
- msm_ 5mo ago
  No this is not what GP said, and I don't get how you reached this conclusion. This is like saying that AES is security through obscurity because it relies on key being secret. See [1] (linked in the OP) to understand the difference better. I am pretty sure everyone who works in security agrees that obscurity is not security. [1] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
  - deleted 5mo ago
    [deleted]
- deleted 5mo ago
  [deleted]
- minitech 5mo ago
  ASLR is (still[1]) not security by obscurity. [1] https://news.ycombinator.com/item?id=43408079 https://news.ycombinator.com/item?id=43408079

i_think_so 5mo ago

I have always replied to colleagues who poohpoohed "security through obscurity!" as if it was proof of ignorance or bad culture with "a password is just a string of obscure characters. ;-)" That's not a serious argument, of course. But consider how the spooks operate in the field. They employ all manner of obscure practices in an attempt to improve their security. Their intentional obscurity (AFAIK) is never allowed to unnecessarily complicate operational practices, which would introduce risk. And they've probably got a lot more theory and no-BS field testing behind their practices than we do. Maybe we should ask them for advice?

locallost 5mo ago

It's useless for the example given because obfuscating JavaScript as protection no longer has any purpose, if you can let AI analyze the code, and/or in this case the API requests. I recently did use a variation of this type of security to prevent a malicious user misusing our services... But I made a not to me an everyone else it was just a quick fix not guaranteed to work long term.

nobrains 5mo ago

My take: Do proper security, but if you are short on time or resources, you can start with security through obscurity, to block a few percentage of attacks, and then when you have time and resources, go ahead and add the proper security measures.

MagicMoonlight 5mo ago

Just because you have a bunker, doesn’t mean you hand the enemy the plans.

rileymat2 5mo ago
This presumes you have a working bunker and not a flawed one because you obscured the details from good actors that could identify problems.

dataflow 5mo ago

I could see AI massively changing the calculus here. Its ability to hack and reverse-engineer (even obfuscated) artifacts may leave obscurity (read: not sharing code or binaries at all) as the primary security mechanism in the industry.

FrasiertheLion 5mo ago
Yeah everything is open source if you’re good at reversing. Models are increasingly capable of converting binaries into source, and excellent at implementing systems when there’s a finite and constrained end state to validate against, which is exactly the profile reversing falls into.

FrasiertheLion 5mo ago

This was largely true before. But AI reduces the cost of comprehension and finding vulnerabilities en-masse to zero, so this no longer holds, and I’m increasingly convinced that hiding in noise and complexity is no longer a valid strategy. But AI symmetrically makes it easier to secure your system so it’s not like all hope is lost even if the transition period will be brutal. I wrote a blog about this: https://tanyaverma.sh/2026/03/01/nowhere-to-hide.html https://tanyaverma.sh/2026/03/01/nowhere-to-hide.html

some_random 5mo ago

Security through Obscurity used to work, with AI it absolutely does not.

rascul 5mo ago

Obscurity can be fine but it's not security. I think of it like cover and concealment in the military. Security is cover. Something you can get behind so the bullets don't hit you. Obscurity is concealment. Harder to see, harder to find, so the enemy doesn't know where to shoot, but it's not stopping any bullets. Both have advantages and disadvantages and can complement each other depending on how they're used.

staticassertion 5mo ago
I don't think that really works because obscurity isn't harder to see or find. I don't know the analogy, it's like standing out in the open and being like "yeah but who would think to look here lol".
- willis936 5mo ago
  I think you're misinterpreting "obscurity" for "lack of obscurity". If you have a vulnerability in an API interface that is completely undocumented that is a vulnerability that is obscured. It's hiding in the woods, not standing in a field. To keep with the analogy: no one is going to stand in a field when people are shooting at you. So then why do a small subset of vocal people online suggest that you just put your bulletproof vest and claim that hiding in the woods, regardless of the vest, is a bad idea?
  - staticassertion 5mo ago
    This isn't about what's a good idea or bad idea. Perhaps it's best to simply leave analogies behind, otherwise we'll just focus on the wrong thing. Security through obscurity merely means that your system is atypical. It's not hidden, it's not secret, it's not hard to find, it's not hard to examine, it's not less visible, etc - there is nothing inherently different about the systems at all other than that one is more common than the other. It's just less typical.
    - willis936 5mo ago
      What you're describing is a thing that is not obscured. Don't refer to things as obscured if they are not obscured. When others talk about about things that are obscured they are talking about things that are obscured, not things that are not obscured.

shevy-java 5mo ago

Mo Beigi unfortunately misses the point. Yes, echo chambers are annoying - I remember this when I challenged them by explaining to me why being superuser is problematic (hint: I countered their arguments easily, then they got very angry about this; I did this on several IRC channels back in the day, just to prove a point. I managed to get banned on one too in the process.) But ... obscurity is NOT a security technique. It just has a catchy slogan. The primary reason why javascript is sometimes - or often - obfuscated is to make it harder to copy/paste and re-use stuff. That's it. Even with sanitizers, de-obfuscating it tends to increase the amount of time one has to spend to uncripple the code. This is the primary function; anything else is just decoy for the most part here. > Security through obscurity is the practice of reducing exposure by keeping an application's inner workings or implementation details less visible to attackers Very clearly his attempt to explain it, is already biased. Is obfuscating JavaScript security through obscurity? I mean if we can not agree to the terms, we can't agree or disagree on anything that follows. Showing fancy images does not add any real argument to the discussion. > For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. Note that this example does not even follow his own (!!!) definition. This has nothing to do with obscurity. It simply is another name than the default login name. What would he expect of people to do? Retain the name? And if they change it, are ALL changes in his opinion valid to "security through obscurity"? He picked wp_8df7b8_users here. Is the name "foobar" instead a better name? Or is it "not obscure enough"?

andix 5mo ago

If the obscurity it is only an additional layer on top of a secure system, it is called "defense in depth". It's a simple probability calculation. If some automated scanning tools can't find your service, a lot of attackers will never know of its existence. So even if it has an unpatched vulnerability, they won't attack it. If 1000 attackers find the vulnerable system, the probability is high at least one is attacking it. If it's only or two one who find it, they might just ignore your system, because they found thousands of others they randomly chose first.

jrnichols 5mo ago

I used to joke that we had "Security through Stupidity" - everything was so half-baked that no intruder would think we were being serious.

VerifiedReports 5mo ago

Reducing the attack volume seems like a good idea in any case. That's why forcing people to use E-mail addresses as user IDs is stupid.

Haven880 5mo ago

The problem with obscurity is that it breeds complacency; the implementer is often uninformed or assumes it protects everything else.

rolph 5mo ago

obscurity is a form of concealment, but not cover. concealment will make specific targeting -less than straightforward,but a scorched earth obliteration will get you along with all else. cover, is a condition that is resistant to attack when you are visible. you should have both, resistance to sequential action when you are specificly targeted, a obfusification of presence, minimizing the frequency of targeting.

0xbadcafebee 5mo ago

Security through obscurity is the same thing as security through praying. A stopped clock is right twice a day.

tkiolp4 5mo ago

The problem with security through obscurity (even if it’s just an “addon”) is that it pollutes your code base, system. It’s just not worth it. Like moving ssh to a different port. If you are the only one working on it, sure fine, as long as you remember the port. If you re working with others, then everyone needs to know the new port, so it has to be documented somehow. It’s a pita

glitchc 5mo ago

When a firewall rule blocks a port, is that security or obscurity?

tptacek 5mo ago

Everybody trying to discuss this gets the framing wrong. Obscurity isn't "bad" or "good". It's not "not" security. Security in the real-world sense is about risk. It fixes an adversary and then applies costs to them. Obscurity changes costs (usually by raising them for the adversary). Depending on the setting and the adversary, obscurity measures can raise costs by a material or immaterial amount. Obscurity measures usually also impose costs on defenders (and, transitively, on the intended users of the system). Those costs are different than they are for adversaries (usually: substantially lower). They might or might not be material. Your general goal is to asymmetrically raise costs on the adversary. Seen that way, it's usually pretty easy to reason about whether obscurity is worth pursuing or not. Don't do it if it doesn't materially raise costs for attackers, or, even if it does, if it doesn't raise costs way less for defenders and users. What trips people up in forums like this is that we're used to dealing with security problems framed in settings where we can impose \infty costs on attackers: foreclosing all known avenues of attack (to something like a mathematical certainty, and stipulating that computer science discoveries may change the cost function tomorrow). In those settings, all obscurity measures have relatively immaterial attacker costs associated. But it's still the same underlying problem! And, in the real world, we're actually rarely operating in model situations where we really can impose \infty costs on attackers.

e40 5mo ago

I remember when port knocking was discussed here on HN many years ago it was shit upon because people said security through obscurity is bad. What really frustrated me, at the time and still (when people shit on it), is that it's not just obscurity, it's also security. Port scans see nothing, but just knowing the port doesn't give you anything. You still need a password or key.

deleted 5mo ago

[deleted]

golem14 5mo ago

I am the Modern Man (Secret, secret, I've got a secret) Who hides behind a mask (Secret, secret, I've got a secret) So no one else can see (Secret, secret, I've got a secret) My true identity

daneel_w 5mo ago

Besides fangs and claws, a substantial amount of both predators and non-predators have highly evolved camouflage.

kk_mors 5mo ago

[flagged]

gnarlouse 5mo ago

If the Mythos era isn't just hype marketing, "sec-scurity" might not be a valid strategy anymore. If you're taking a beat because you're small and irrelevant, you could still be massively fucked over a breach. Mom & Pop code shops might be high risk if nation-state level vulnerability-exploitation becomes economically viable to any disgruntled prick.

keithnz 5mo ago

One thing I like about some layer of obscurity is not so much anyone directly attacking you, it's someone generically attacking you because you happened to use a common thing that someone finds a security hole with.

costco 5mo ago

reCAPTCHA is a great success story of security through obscurity because probably less than 100 people have reverse engineered it and much less than that have produced a working solver for it that doesn't require a headless browser. Snapchat would be another good example - almost no one is going to put in the work to understand this [0]. Most companies just half ass it though and accordingly achieve nothing with the obscurity at all besides worse performance. [0] https://web.archive.org/web/20201128060507/https://hot3eed.github.io/snap_part1_obfuscations.html https://web.archive.org/web/20201128060507/https://hot3eed.g...

ChrisMarshallNY 5mo ago

I don't think "obscurity" really buys you much (especially these days, with LLMs). However "Not Having Stuff to Steal" works like a charm. It's thousands of years old, and has never gone out of style. I know that it's considered blasphemy, hereabouts, but I've found that not collecting information that I don't absolutely need is pretty effective. Even if someone knocks down all my gates and fences, they'll find the fox wasn't worth the chase. It does make stuff like compiling metrics more of a pain, but that's my problem; not my users'.

danparsonson 5mo ago
That's fine if the goal of breaking in is immediate theft; it might also be more along the lines of leaving something behind.
- ChrisMarshallNY 5mo ago
  Not sure if obscurity buys you anything, then. In that case, it's all about standard security practices.
keeda 5mo ago
Totally agreed, to me data is just like code: extremely valuable for the functionality it provides, but in most other ways a serious liability. That said: > I don't think "obscurity" really buys you much (especially these days, with LLMs). Actually I think it does so even more with LLMs. As has been posited before (particularly on the threads about open source projects going closed source) security comes down to who has paid more attention to the code, the attacker or the defender. And of course, these days attention is measured in tokens. We know that LLM's are pretty capable of reversing-engineering to figure out an application's logic, but I would bet it takes many more tokens than reading the code or other public information directly. As such, obscurity adds an important layer to security: increasing the costs on the attacker. Security has always been a numbers game, but now the numbers will overwhemingly be tokens and scale. If the defenders can cheaply raise the costs on the attackers by adding simple layers of obscurity, it can act as a significant deterrent at scale. I wonder if we'll even see new obfuscation techniques that are cheap to implement but targeted specifically at LLMs...

mazone 5mo ago

In a corporate setting my experience is that it is rarely worth it to add any obscurity on top of security. Your biggest challenge is getting peoples time and resources, and you need to use that time to implement security controls. A secondary objective you have is to build security culture over time and teach people too see patterns where more security is needed, so it is important to select what to teach to get maximum impact.

corvad 5mo ago

Security through obscurity is bad. Security AND obscurity is fine. There's a very clear distinction here.

EGreg 5mo ago

Kerchkoff would beg to disagree. Please do not refuse a beggar: https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

h4kunamata 5mo ago

It is bad! The way how human brain works, anything that gives you the slightly sense of "security", will make you to leave as it is without implementing an actual solution. That security by obscurity is now a security issue.

danpalmer 5mo ago

> For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. In some ways this is not security through obscurity. If you don't have a way to enumerate tables, this is in effect another short password being added to the data. In the same way you could say that the "obscurity" of users' passwords is security through obscurity... except we still use passwords. The idea of security through obscurity being bad stemmed from the idea that a cryptosystem should still be secure when you know how it works. That's all. In that way, you know how WordPress works, and yet you don't have access. You know how passwords work, and yet don't have access. Obfuscating code is interesting because it sort of sits between the two. You could execute the code, and you may know how the obfuscation scheme works, but you can't de-obfuscate easily and see the original intent, and that way it's useful. The fact that you can still execute the code does however limit the impact.

pbgcp2026 5mo ago

... perfect topic for Hacker news ...

OhMeadhbh 5mo ago

Saying anything about security without mentioning the nature of the threat is bad. It's also industry common practice. Obfuscating JS is probably a decent defence against your 9 year old brother. It is not against a motivated, well funded state sponsored attacker. Part of what bugs me about English is the practical ambiguity of the colloquial understanding of what "<foo> is <bar>" implies. Does it mean that all foos are also bars or does it mean there exists a foo where that foo is also bar? Does it mean foo is always bad or foo is often bar? Dutch is my first language and I grew up in South Viet Nam, Nigeria and Texas. I did not get the standard programming.

srdjanr 5mo ago
The author gave a few examples where compiled/minified code is public (Javascript and games) or automated vuln exploits (Wordpress example). That does explain nature of threat well enough for me. There's a whole spectrum between 9 year old and a motivated state actor, and obfuscation is effective for a big part of the spectrum.
- OhMeadhbh 5mo ago
  I was talking about the click-baity title more than the content.

OhMeadhbh 5mo ago

And the second thing that bugs me about this interaction... Sure... "Security" is a process. It is a way of looking at things. It is proper use of tools and awareness of threat when designing software. But it is also a set of trade-offs and relationships between architectural components. It worries me that this isn't displayed in the interaction described in the post

maxrev17 5mo ago

The AI era shows we relied on it for decades in some big software anyway despite claiming it’s bad :p ahaha

high_na_euv 5mo ago

Wtf, why ppl struggle so hard with simple concept Obscurity increases the bar, and now, some actors will be prevented just by it, some delayed and some not affected at all, but after all you dont know who is attacking you and their skills!

viccis 5mo ago
It's just a good component of a defense in depth approach. Where it's bad is when it's the only defense. Putting a sensitive server behind port knocking will cut down on 99.99999% of random internet IPs spraying attacks at it, so it's worth doing. Just don't rely on it for the only auth check.

Havoc 5mo ago

Yeah people took a solid conceptual reminder and turned it into an absolute prohibition.

WesolyKubeczek 5mo ago

Security through obscurity is only bad when it’s the only measure used. If proper security is also in place, it is the cherry on top. For example, while I know that ssh bruteforcing bots won’t enter my server no matter how much they try, putting ssh on a non-standard port reduces the number of tries to zero.

ndc 5mo ago

Cixin Liu's Dark Forest theory is security through obscurity. If you don't have any other defense mechanism, at least try to hide.

ceving 5mo ago

Outch! Security is security. Obscurity is obscurity. Piety is piety. All three have nothing in common.

TZubiri 5mo ago

The source of this bias is voyeurism. It's always someone outside your org telling you that obscurity is bad, and that you should definitely publish all your source code to let them see. It's self serving outside judgment to get you to provide them value. On the other side of the coin, there is a bias towards this trope that comes from exhibitionism: those of us who hold that security through obscurity is valuable, will usually not publish our thoughts on other security mechanisms, since we will consider that doing so decreases our security, whereas those that believe in the trope, will publish all of their thoughts on security, as they do not depend on or value the secrecy of their strategies.

TZubiri 5mo ago

>For example, wp_users becomes wp_8df7b8_users. This is often dismissed as "worthless" because it is security through obscurity. >My website was vulnerable. However, I was not impacted by any attacks, and I updated the plugin to a patched version a few days later. While other sites were "nulled" and destroyed, I was spared. I later found a PoC script on GitHub showcasing the exploitation. Using that PoC on my own site failed with a generic error like Table 'wordpress.wp_users' doesn't exist. The biological sciences fully support this form of protection. One of the main benefits of the whole of sexual reproduction is based on this principle. Mutations introduce diversity to populations which allows otherwise extinction events to just affect a fraction of the population. So yeah, maybe the university of Open Source internet considers your approach to security to be baseless, but (in addition to your empirical experience), security through obscurity is well recognized in zoology.

trashb 5mo ago

Security is the lock on the safe. Obscurity is the information you need to find the safe. All security can eventually be broken, given enough time, this is why A very useful measure for the security of a lock is how long it takes to break. The same is true for cryptography. Obscurity can add a buffer before you can start breaking the lock and it can act as a deterrent for opportunistic attacks. Additionally it can help with signal to noise and monitoring of the lock. This is why you have a lock on your front door and don't tell anyone you meet where exactly in your house you store your valuable jewels (preferably out of sight). You also want to monitor anyone in your garden more closely than on the road passing by.

allknowingfrog 5mo ago
Isn't it all just information? The lock code and the location of the safe are both just data. I think it's possible that all security is obscurity.

blamestross 5mo ago

I feel like nobody actually understands the real reason security through obscurity is so bad. It results in dead cryptographers. The implementor becomes the weakest link in the chain, and entities with a tolerance for violence can fix that problem.

grayhatter 5mo ago

> Security through obscurity, as an additional layer, is good! If and only if the security advantage it gives outweighs the the numerous disadvantages. It never* does. That's why the comment calling it bad got so many upvotes. Mixed in with those cargoculting the meme, are people like me who have had to deal with obfuscation techniques, written by someone else, that the bad guys understood before I did. Obfuscation as a security measure is bad, because it feels like it's positives can compete with it's negatives; but that's rarely the case. *: effectively never

stavros 5mo ago
> It never* does. Can you substantiate this claim a bit?
- grayhatter 5mo ago
  > Can you substantiate this claim a bit? I might, depending on how much objective evidence you'd demand for substance. The problem with obscurity as a security feature, is the group(s) that feels the impact the most. Heuristically, you can create 3 groups that are impacted. APTs, skiddies, devs/maintainers. Obscurity will stop skiddies... effectively 100% ....but so will everything else. Regular updates, and a half good password also stops skiddies to effectively 100%. Obscurity has a net negative effect on the system because it doesn't increase the attack cost on skiddies, but does increase the maintenance cost to engineering. This is the vast majority of attackers you'd want to deal with. Your Advanced Persistent Threats, will be slowed by some amount of obscurity, but they will not be be stopped by it at all, at best it's a road bump. Persistence and intent will overcome any amount of obscurity. Same idea as give enough eyes, all bugs are shallow. Given enough time, any/all amount of obscurity will be understood by the baddies. The downsides to obscurity is it's cost both to maintenance of the system as a whole, but also to the heuristics non-security developers use to find/understand bugs. Obscurity introduces significant complexity into the system. That complexity makes it harder to find and understand real bugs, but worse, it also obscures the security of the system itself to non-experts. I do believe we'll never escape the reality that most developers see obscurity, and think "this 'secret' makes this secure" but obscurity is *not* a secret. It doesn't provide additional security/safety. It only marginally increases the time to find and deploy the exploit. Here, this extra layer of obscurity actually decreases security because developers will stop looking for ways to harden the system, because this "secret" is good enough. I.e. the obscurity added only has the opportunity cost replacing the effort that would have been spent on real security. If you have a full security team managing the obscurity the maintenance cost to the system, will be less than the cost to your APTs, but if you don't have a full time team working on it (or at least a strong expert in both how obscurity benefits the system, but more important, a strong expert in real security), the maintenance costs will exceed the time/delay until exploitation. It's likely that I could deploy some system securely, with obscurity layered over top. But I often don't because I don't wanna deal with it. It makes debugging harder. Depending on what specific flavor, it might also give the baddies a place to hide, because the signal of attacks no longer looks like the signal everyone expects. If you can avoid *ALL* of the pitfalls. It will, without a doubt, increase the time to exploit. The problem being, if you're unable to avoid all the pitfalls of it, the negative aspects will have a much stronger cost and influence on the maintenance of the system, and the devs, contrasted with the cost it might have on any attack.

morpheos137 5mo ago

prime number based encryption is litterally security through obscurity at scale. nature knows no other way to secure information besides hashing, physical barriers or distance or time or noise barriers.