Security through obscurity means relying on the secrecy of the design of a system to keep it secure. Kerchkoff's principle states that the security of a system should not rely only on obscurity.

learn more… | top users | synonyms

28
votes
5answers
4k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
34
votes
3answers
2k views

The valid role of obscurity

That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
39
votes
6answers
5k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
75
votes
14answers
8k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
43
votes
4answers
9k views

Is publishing your public IP address a security threat?

I work for a large-ish company (thousands of employees across multiple locations). I recently needed to know what the possible public IP addresses are, so that a vendor could identify us (presumably ...
92
votes
15answers
6k views

At what point does something count as 'security through obscurity'?

So, I keep finding the conventional wisdom that 'security through obscurity is no security at all', but I'm having the (perhaps stupid) problem of being unable to tell exactly when something is 'good ...
17
votes
1answer
2k views

Use of obscure URL for security [duplicate]

My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines. To access the ...
13
votes
9answers
849 views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries ...
5
votes
1answer
684 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
2
votes
0answers
169 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
29
votes
3answers
15k views

How risky is connecting to a hidden wireless network?

According to something I spotted something in a set of directions for connecting to a hidden wireless network from windows 8 found here (located under Step 1 > "Troubleshoot connection problems" > ...
10
votes
4answers
933 views

How to define security requirements to ensure that developers… do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
6
votes
5answers
686 views

Hiding version - valuable or just security by obscurity?

Many automatic security scanners have built in rules that alert on the presence of software version, and in many security lists version exposure to arbitrary person accessing the system is mentioned ...
37
votes
9answers
2k views

Use additional “password” in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com, ...
16
votes
4answers
7k views

Processor microcode manipulation to change opcodes?

I had recently thought of an extreme way of implementing security by obscurity and wanted to ask you guys if it's possible. Would a person with no access to special processor documentation be able ...
33
votes
8answers
4k views

Isn't all security “through obscurity”?

I know that one shouldn't rely on "obscurity" for their security. For example, choosing a non-standard port is not really security, but it also doesn't usually hurt to do so (and may help mitigate ...
23
votes
4answers
3k views

NSA Suite A Cryptography: Security through obscurity?

What is the opinion of scholars, cryptographers on NSA Suite A? Containing unpublished algorithms. Could it really be that much better than the published algorithms besides being obscure and not ...
3
votes
4answers
726 views

Demonstration of how security through obscurity fails to work

I need to demonstrate that security through obscurity fails twice in the following scenario. I've a secret KEY. User A gets MessageX = SecretTransformation(KEY, SecretValue1); User B gets MessageY ...
30
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
7
votes
3answers
155 views

Risk of running services on ports >1024

In a Reddit thread on securing SSH access to a Raspberry Pi, one commenter recommended running SSH on a non-standard port of 8123. Another commenter had this to say on the matter: Don't change ...
3
votes
4answers
979 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
5
votes
1answer
325 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...