<story><title>Security by obscurity is underrated</title><url>https://utkusen.com/blog/security-by-obscurity-is-underrated.html</url></story><parent_chain><item><author>n0on3</author><text>It seems to me that the article is missing a few of points on what &amp;quot;security by obscurity&amp;quot; means.&lt;p&gt;From Wikipedia: &amp;quot;reliance [...] on design or implementation secrecy as _&lt;i&gt;the main method&lt;/i&gt;_ of providing security [...]&amp;quot;&lt;p&gt;So, to use the model mentioned in the article, a single slice of cheese. It&amp;#x27;s not &amp;quot;an additional layer of defense&amp;quot;, it&amp;#x27;s the main one (so you have other... weaker layers? ¯\_(ツ)_&amp;#x2F;¯)&lt;p&gt;Second, &amp;quot;reliance on secrecy of design and implementation&amp;quot; is different from &amp;quot;reliance on secrecy of _whatever-else_&amp;quot;, because design and implementation are most often either easily discoverable (sure, occasional skids might not scan port 64323 but what about someone who can observe your traffic?) or pretty much guaranteed to be discovered by adveraries with (not even as much as one might think) time and motivation.&lt;p&gt;Third, some of the examples mentioned (e.g., the decoy cars) are not even security by obscurity, that&amp;#x27;s called deception.&lt;p&gt;So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should &lt;i&gt;never&lt;/i&gt; be your only (or your main) layer of defense.&lt;p&gt;Security by obscurity is not underrated, by definition it&amp;#x27;s just bad.</text></item></parent_chain><comment><author>PragmaticPulp</author><text>This is actually the misunderstanding that the author is talking about:&lt;p&gt;People commonly misunderstand the concept and assume that obscurity is a bad practice in general, even when used as a secondary layer. It&amp;#x27;s not uncommon for junior engineers to object to any level of obfuscation or security because they can imagine a scenario where a sufficiently skilled attacker can defeat it, but that&amp;#x27;s missing the point. Slowing down your adversaries and weeding out the low-effort attacks is still valuable.&lt;p&gt;&amp;gt; So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should never be your only (or your main) layer of defense&lt;p&gt;That&amp;#x27;s exactly what the author says in the article. I don&amp;#x27;t see where the author is disagreeing with what you said.&lt;p&gt;I would go one step further and say that engineers commonly underestimate the volume of low-effort attacks that will pour in at scale. Some of these, such as brute-forcing or DDoS, can be disruptive to users unless you have perfect rate limiting (which you won&amp;#x27;t at first). Adding layers of obscurity before attackers can authenticate with and interact with core services can dramatically reduce the volume of these low-effort attacks. The skilled attackers tend to be more surgical.</text></comment>
<story><title>Security by obscurity is underrated</title><url>https://utkusen.com/blog/security-by-obscurity-is-underrated.html</url></story><parent_chain><item><author>n0on3</author><text>It seems to me that the article is missing a few of points on what &amp;quot;security by obscurity&amp;quot; means.&lt;p&gt;From Wikipedia: &amp;quot;reliance [...] on design or implementation secrecy as _&lt;i&gt;the main method&lt;/i&gt;_ of providing security [...]&amp;quot;&lt;p&gt;So, to use the model mentioned in the article, a single slice of cheese. It&amp;#x27;s not &amp;quot;an additional layer of defense&amp;quot;, it&amp;#x27;s the main one (so you have other... weaker layers? ¯\_(ツ)_&amp;#x2F;¯)&lt;p&gt;Second, &amp;quot;reliance on secrecy of design and implementation&amp;quot; is different from &amp;quot;reliance on secrecy of _whatever-else_&amp;quot;, because design and implementation are most often either easily discoverable (sure, occasional skids might not scan port 64323 but what about someone who can observe your traffic?) or pretty much guaranteed to be discovered by adveraries with (not even as much as one might think) time and motivation.&lt;p&gt;Third, some of the examples mentioned (e.g., the decoy cars) are not even security by obscurity, that&amp;#x27;s called deception.&lt;p&gt;So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should &lt;i&gt;never&lt;/i&gt; be your only (or your main) layer of defense.&lt;p&gt;Security by obscurity is not underrated, by definition it&amp;#x27;s just bad.</text></item></parent_chain><comment><author>jjeaff</author><text>I agree with your understanding of security by obscurity. But I think the popular understanding has started to be more along the lines that the author counters. That if any security measure is &amp;quot;obscurity&amp;quot; then don&amp;#x27;t do it, it&amp;#x27;s bad.</text></comment>