Security through obscurity means relying on the secrecy of the design of a system to keep it secure. Kerchkoff's principle states that the security of a system should not rely only on obscurity.
20
votes
4answers
1k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
30
votes
4answers
2k views
Is publishing your public IP address a security threat?
I work for a large-ish company (thousands of employees across multiple locations). I recently needed to know what the possible public IP addresses are, so that a vendor could identify us (presumably ...
64
votes
8answers
4k views
How would one crack a weak but unknown encryption protocol?
I was reading this interesting question:
Is my developer's home-brew password security right or wrong, and why?
It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
67
votes
16answers
2k views
At what point does something count as 'security through obscurity'?
So, I keep finding the conventional wisdom that 'security through obscurity is no security at all', but I'm having the (perhaps stupid) problem of being unable to tell exactly when something is 'good ...
5
votes
3answers
513 views
Processor microcode manipulation to change opcodes?
I had recently thought of an extreme way of implementing security by obscurity and wanted to ask you guys if it's possible.
Would a person with no access to special processor documentation be able ...
2
votes
4answers
211 views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
0
votes
6answers
316 views
What sort of security method is this called (if it has a name)?
I have thought of a way of securing access to an application interacting with another application.
Using this method
Application 1 - "What is the sum of 1+1?"
Application 2 - "3"
Application 1 - ...
18
votes
5answers
1k views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
1
vote
4answers
1k views
blocking direct access to files via url input while still allowing a script on server to access files
I am trying to accomplish the following and have been unsuccessful. I would appreciate any insight. Scenario: http://www.mydomain.com/filename.html is a webpage. On this webpage I am running a ...
18
votes
3answers
750 views
Should Stack Exchange be more obscure in its systems' structure?
I've noticed that Stack Exchange always reveals the detailed structure of its servers and systems (see these blog posts). And also the exact results of their tests and points of weakness (see the old ...
15
votes
4answers
934 views
NSA Suite A Cryptography: Security through obscurity?
What is the opinion of scholars, cryptographers on NSA Suite A? Containing unpublished algorithms. Could it really be that much better than the published algorithms besides being obscure and not ...
19
votes
5answers
980 views
Is it alright to tell everyone your encryption information?
I have an account in an online banking system and they have the FAQ with something like this:
How secure is the <Online Banking System Name>?
Each page you view and any information ...
3
votes
5answers
181 views
Is there any security value of creatively naming folders containing sensitive files?
A friend of mine asked me if he could sign his tax returns without printing them out. While helping him, he insisted on naming the folder containing images of his signature and initials a completely ...
4
votes
2answers
141 views
How do I remove or anonymize file names and path that are stored in compiled .NET exe output?
When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that ...
5
votes
5answers
269 views
Hiding version - valuable or just security by obscurity?
Many automatic security scanners have built in rules that alert on the presence of software version, and in many security lists version exposure to arbitrary person accessing the system is mentioned ...
25
votes
3answers
672 views
The valid role of obscurity
That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
7
votes
4answers
298 views
Will passphrases always be secure?
In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
3
votes
3answers
292 views
Demonstration of how security through obscurity fails to work
I need to demonstrate that security through obscurity fails twice in the following scenario.
I've a secret KEY.
User A gets MessageX = SecretTransformation(KEY, SecretValue1);
User B gets MessageY ...
7
votes
5answers
384 views
Which graphic image formats contain revision history? Does the image editing software being used matter?
It's common knowledge among graphic designers that they can rename a PDF file and import it into Illustrator and access the "layers" within the document, revealing hidden information.
I don't know ...
3
votes
1answer
161 views
Can wildcard certificates hide/obscure the hostname in a TLS connection?
I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
10
votes
4answers
481 views
How to define security requirements to ensure that developers… do not provide security by obscurity?
I tried to explain that security by obscurity should not be used but let's say I was challenged!
I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
12
votes
9answers
656 views
Anybody have additional information on the EMC RSA SecurID compromise?
The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
10
votes
5answers
1k views
Is Skype secure enough to transmit passwords?
Is it considered "secure" to send a password in a skype message and delete the message after the recipient remembered the password?
