Security through obscurity means relying on the secrecy of the design of a system to keep it secure. Kerchkoff's principle states that the security of a system should not rely only on obscurity.

learn more… | top users | synonyms

19
votes
5answers
1k views

Is it alright to tell everyone your encryption information?

I have an account in an online banking system and they have the FAQ with something like this: How secure is the <Online Banking System Name>? Each page you view and any information ...
1
vote
4answers
12k views

blocking direct access to files via url input while still allowing a script on server to access files

I am trying to accomplish the following and have been unsuccessful. I would appreciate any insight. Scenario: http://www.mydomain.com/filename.html is a webpage. On this webpage I am running a ...
7
votes
5answers
1k views

Which graphic image formats contain revision history? Does the image editing software being used matter?

It's common knowledge among graphic designers that they can rename a PDF file and import it into Illustrator and access the "layers" within the document, revealing hidden information. I don't know ...
5
votes
1answer
325 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
10
votes
5answers
3k views

Is Skype secure enough to transmit passwords?

Is it considered "secure" to send a password in a skype message and delete the message after the recipient remembered the password?
13
votes
9answers
849 views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
34
votes
3answers
2k views

The valid role of obscurity

That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
10
votes
4answers
931 views

How to define security requirements to ensure that developers… do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...