Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Security through obscurity isn't real security.
That's why theoretically, closed source software is a wrong solution.
A software, example an operating system still needs to be secure when all of it's elements are known to source code level, only the private keys are kept secret.

Q: Who are the people (that work in security, cryptography) who said these words? The more examples for people are there the better.

This question will be useful in future arguments when people need to discuss open vs. closed source software models regarding security.

share|improve this question
    
The last sentence looks like an alternative formulation of the Kerckhoff's principle. –  Rob W Oct 10 '13 at 7:18

1 Answer 1

up vote 0 down vote accepted

"Security by Obscurity" is among the most commonly used (sometimes misused) phrase in security industry. The phrase is supported by giving examples like, leaving the back door of your house open, as nobody knows about it or like keeping the key of your house under the door mat or in a flower pot next to the door.

As per wikipedia, the origin of the phrase can be traced back to the Kerckhoff's principle, "a system should be secure because of its design, not because the design is unknown to an adversary".

One such example I can remember is encryption and authentication process in Whatsapp messenger (though in case of encryption, it could be a case of ill-informed cryptographic implementation, but considering it is a well funded company and still lacking on such important aspect, makes me think on lines of "security by obscurity" as well).

As per wikipedia, NIST in its document on "Guide to General Server Security" talks of this security principle. Bruce Schneier in this article talks about it as well. There are many other references on wikipedia like, Peter Swire, Jay Beale etc.

This brings to the important part of the question, does it prove that open source is better than closed source. In my view, it depends on the size of the project, how many developers are working, background of developers, and quality control practiced. There is no way to tell which one is more secure than the other one, just by looking at the model of development used. Historically, both the camps have chequered history.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.