Tag Info

Hot answers tagged

74

The misconception that you're having is that security through obscurity is bad. It's actually not, security only through obscurity is terrible. Put it this way. You want your system to be complete secure if someone knew the full workings of it, apart from the key secret component that you control. Cryptography is a perfect example of this. If you are ...


59

I'll extend on one point at a slightly more abstract level about why public authenticated spaces are preferable to hidden unprotected spaces. The other answers are all perfectly good and list multiple attacks one should know better to avoid. Everyone with formal training should've heard at some point of the Open Design security principle. It states that ...


50

Since we're talking theoretically, here are several reasons why a random URL alone is not sufficient enough to protect confidential data: URLs can be bookmarked. URLs are recorded in the browser history (public kiosk). URLs are displayed in the address bar (shoulder surfers). URLs are logged (think 3rd party proxy). URLs can be leaked via Referrer headers ...


49

An unknown "encryption" algorithm has been historically achieved at least once. I am speaking of Minoan Linear B script, a writing method which was used in Crete around 1300 BC. The method was lost a few centuries later, with the death of all practitioners and the overall collapse of civilization during the so-called Greek Dark Ages. When archaeologists ...


49

Your public facing IP address is for most intents and purposes public information. No security should be dependent on it being private, however it's not something you want to wave around willy nilly necessarily (just like you wouldn't wave your home address around) but it also isn't something that is hard for someone to find with generally minimal effort if ...


45

Much of the work on passwords and keys is related to controlling where they are stored and copied. A password is stored in the mind of a human user. It is entered on a keyboard (or equivalent) and goes through the registers of a CPU and the RAM of the computer, while it is processed. Unless some awful blunder is done, the password never reaches a permanent ...


44

Think about it this way On one hand, there's nothing wrong with it. If your application is secure enough against SQL Injection, then an attacker won't be able to do much with that information. Unless you're naming your tables table_2231 and your columns column_4231 (in which case I hate you), it's not gonna be difficult to guess your tables names anyway. ...


43

My opinion (and I am a cryptographer -- I have a shiny diploma which says so) is that: We cannot speculate on unknown algorithms, because they are, well, unknown. NSA is like all secret services in the World, they really love secrecy and will practice it for the sake of it. So the fact that their algorithms are not published is in no way indicative of some ...


40

I personally think you're doing alright. As long as your underlying login method is secure, add as many obscurity layers as you want. I have worked with some clients that wanted the exact thing you're trying to achieve. I've always used one of these two methods: Cross-Site login form: A local .html file that has a login form submitting to the ...


40

The risk here is in believing that a "hidden SSID" changes anything to the security. A non-hidden SSID means that the router will shout at regular intervals "hello everybody, I am Joe the Router, you may talk to me !". A hidden SSID means that the client machine (not the attacker's machine) will shout at regular intervals "Hey, Joe, where are you ? Please ...


35

Secrets are hard to keep secret. The larger a secret is and the more people that know it, the sooner it is likely to leak. Good secrets are: Small. Known only by one person. Easy to change. When we accuse someone of security through obscurity what we are really saying as that we think their secret could be smaller, known by fewer people and/or easier ...


34

Your network guy might have a good reason for not wanting to share the information you enquired about. You see, what you describe you asked him of is not the IP range (CIDR) your company has been assigned to, but actual list of individual live IPs within that ASN. Now, getting the CIDR range that your organisation was assigned to its ASN is relatively easy, ...


34

See this answer. The main point is that we make a sharp distinction between obscurity and secrecy; if we must narrow the difference down to a single property, then that must be measurability. Is secret that which is not known to outsiders, and we know how much it is unknown to these outsiders. For instance, a 128-bit symmetric key is a sequence of 128 bits, ...


31

Yes, it is bad security practice indeed. When using the Forgotten Password feature, the site should respond with a message: "An email has just been sent to the specified email address, if it exists and is registered within our system. Please read the email and follow the instructions." Or simply: "Please check your email inbox for instructions on how to ...


30

We don't just want secrecy. We want quantifiable secrecy. The point is not only to ensure confidentiality of data, but also to be able to know that we indeed ensured confidentiality of data. When we have a public algorithm and a secret key, secrecy can be quantified. For instance, if we use AES with a 128-bit key, then we know that an attacker will have to ...


29

To attack a cryptographic protocol, you have the following attack methods Known plaintext: Trying to find correlations between the plaintext you have and the corresponding ciphertext. Chosen plaintext: Encrypting specific plaintext and studying the changes to the ciphertext as the plaintext changes. Choosen ciphertext: Decrypting specific ciphertext and ...


28

No. You should always assume that the attacker knows everything. Security by obscurity is considered bad practice by most non-govt developers and architects. The obstacle it provides is minimal, and if something is kept secret, it may be so to hide a flaw. Kerckhoffs's principle is important to look at. Edit: This answer discusses security by obscurity in ...


27

Interesting question. My thoughts on this are that obscuring information is helpful to security in many cases as it can force an attacker to generate more "noise" which can be detected. Where obscurity is a "bad thing" can be where the defender is relying on that obscurity as a critical control, and without that obscurity, the control fails. So in ...


21

Security by obscurity is where you rely upon some fact which you hope is not known to an attacker. A major problem with this is that once the fact is disclosed, the security scheme is rendered useless. However, all SSH is doing is obscuring information. It relies on the hope that an attacker won't think to guess the correct cryptographic key. When the ...


21

The reason that relying on security through obscurity is frowned upon, is that once the algorithm is leaked or broken, you've totally lost all the security gained by obscurity. So if any actor with access to the algorithm ever leaves your organization, or you are hacked, or source code (or an executable) of a encryption/decryption program is somehow ...


21

The problem with secret URLs is that they can be leaked in a variety of ways. Images, Javascript, Stylesheets, and fonts can leak the URL of the webpage you are visiting. For example, if your secret page includes something like <img src="http://example.com" /> then when your browser grabs the image it may include the URL to the secret page in the ...


18

If you are only sending one short message (a sentence or two), then it would be difficult to break. However, once you start sending large messages or frequent messages it would probably be very easy to break using techniques like language letter frequency. For example, with many simple encryption techniques, an "a" will always translate to the same ...


17

There are a couple of things to consider. First, coming up with a secure encryption algorithm is hard. Not kind of hard, but really mind-bendingly hard in that we can't actually prove that encryption algorithms are actually secure, but only demonstrate that with what we know, we don't know how to break them with effort of less than 2^n for some large ...


16

An interesting data point here is the DES s-box constants. Wikipedia NSA Wikipedia DES NSA recommended changes in the S-box constants to make DES resistant to differential analysis, which was unknown in the academic and commercial cryptography world at the time. In that case, they were able to make that improvement in a way that was opaque to the users of ...


16

Edit 2: Since this has been migrated to Security.SE, I should probably preface this with with: I'm not a professional cryptographer, and there are many, many reasons why you should never roll your own security. Having said that: It's a form of challenge-response authentication (with different challenges being sent each time). The algorithm to find the ...


15

I think nobody has said it aloud here, so I will. If a cryptographer is given only one ciphertext with no means to get more, the ciphertext is short and no knowledge of the plaintext is given, it is near impossible to decrypt the text. The only way this is still possible is if the cipher is around the difficulty level of a substitution cipher. Given the ...


14

Your method is functionally equivalent to requiring authentication with two passwords, the Referer being one of them. A more common variant is to use a secret URL, i.e. to make the "special string" part of the path to the private site. Including the secret string in the URL may include some extra details to think about (e.g. users can bookmark it, meaning ...


14

You're very much getting into the realm of "Here be dragons" when you look into hardware manipulation like this. I don't know of any research or in-the-wild attack that has done any practical experimentation with this, so my answer will be purely academic. First, it's probably best if I explain a bit about how microcode works. If you're already clued up on ...



Only top voted, non community-wiki answers of a minimum length are eligible