Tag Info

Hot answers tagged

70

The misconception that you're having is that security through obscurity is bad. It's actually not, security only through obscurity is terrible. Put it this way. You want your system to be complete secure if someone knew the full workings of it, apart from the key secret component that you control. Cryptography is a perfect example of this. If you are ...


48

An unknown "encryption" algorithm has been historically achieved at least once. I am speaking of Minoan Linear B script, a writing method which was used in Crete around 1300 BC. The method was lost a few centuries later, with the death of all practitioners and the overall collapse of civilization during the so-called Greek Dark Ages. When archaeologists ...


44

Your public facing IP address is for most intents and purposes public information. No security should be dependent on it being private, however it's not something you want to wave around willy nilly necessarily (just like you wouldn't wave your home address around) but it also isn't something that is hard for someone to find with generally minimal effort if ...


44

Think about it this way On one hand, there's nothing wrong with it. If your application is secure enough against SQL Injection, then an attacker won't be able to do much with that information. Unless you're naming your tables table_2231 and your columns column_4231 (in which case I hate you), it's not gonna be difficult to guess your tables names anyway. ...


39

I personally think you're doing alright. As long as your underlying login method is secure, add as many obscurity layers as you want. I have worked with some clients that wanted the exact thing you're trying to achieve. I've always used one of these two methods: Cross-Site login form: A local .html file that has a login form submitting to the ...


38

Much of the work on passwords and keys is related to controlling where they are stored and copied. A password is stored in the mind of a human user. It is entered on a keyboard (or equivalent) and goes through the registers of a CPU and the RAM of the computer, while it is processed. Unless some awful blunder is done, the password never reaches a permanent ...


36

My opinion (and I am a cryptographer -- I have a shiny diploma which says so) is that: We cannot speculate on unknown algorithms, because they are, well, unknown. NSA is like all secret services in the World, they really love secrecy and will practice it for the sake of it. So the fact that their algorithms are not published is in no way indicative of some ...


33

Secrets are hard to keep secret. The larger a secret is and the more people that know it, the sooner it is likely to leak. Good secrets are: Small. Known only by one person. Easy to change. When we accuse someone of security through obscurity what we are really saying as that we think their secret could be smaller, known by fewer people and/or easier ...


32

See this answer. The main point is that we make a sharp distinction between obscurity and secrecy; if we must narrow the difference down to a single property, then that must be measurability. Is secret that which is not known to outsiders, and we know how much it is unknown to these outsiders. For instance, a 128-bit symmetric key is a sequence of 128 bits, ...


30

The risk here is in believing that a "hidden SSID" changes anything to the security. A non-hidden SSID means that the router will shout at regular intervals "hello everybody, I am Joe the Router, you may talk to me !". A hidden SSID means that the client machine (not the attacker's machine) will shout at regular intervals "Hey, Joe, where are you ? Please ...


28

To attack a cryptographic protocol, you have the following attack methods Known plaintext: Trying to find correlations between the plaintext you have and the corresponding ciphertext. Chosen plaintext: Encrypting specific plaintext and studying the changes to the ciphertext as the plaintext changes. Choosen ciphertext: Decrypting specific ciphertext and ...


28

Your network guy might have a good reason for not wanting to share the information you enquired about. You see, what you describe you asked him of is not the IP range (CIDR) your company has been assigned to, but actual list of individual live IPs within that ASN. Now, getting the CIDR range that your organisation was assigned to its ASN is relatively easy, ...


27

No. You should always assume that the attacker knows everything. Security by obscurity is considered bad practice by most non-govt developers and architects. The obstacle it provides is minimal, and if something is kept secret, it may be so to hide a flaw. Kerckhoffs's principle is important to look at. Edit: This answer discusses security by obscurity in ...


20

Interesting question. My thoughts on this are that obscuring information is helpful to security in many cases as it can force an attacker to generate more "noise" which can be detected. Where obscurity is a "bad thing" can be where the defender is relying on that obscurity as a critical control, and without that obscurity, the control fails. So in ...


20

Security by obscurity is where you rely upon some fact which you hope is not known to an attacker. A major problem with this is that once the fact is disclosed, the security scheme is rendered useless. However, all SSH is doing is obscuring information. It relies on the hope that an attacker won't think to guess the correct cryptographic key. When the ...


16

Edit 2: Since this has been migrated to Security.SE, I should probably preface this with with: I'm not a professional cryptographer, and there are many, many reasons why you should never roll your own security. Having said that: It's a form of challenge-response authentication (with different challenges being sent each time). The algorithm to find the ...


15

I think nobody has said it aloud here, so I will. If a cryptographer is given only one ciphertext with no means to get more, the ciphertext is short and no knowledge of the plaintext is given, it is near impossible to decrypt the text. The only way this is still possible is if the cipher is around the difficulty level of a substitution cipher. Given the ...


14

Your method is functionally equivalent to requiring authentication with two passwords, the Referer being one of them. A more common variant is to use a secret URL, i.e. to make the "special string" part of the path to the private site. Including the secret string in the URL may include some extra details to think about (e.g. users can bookmark it, meaning ...


14

Exposing table names might have broader consequences than you expect. For instance you could be putting your company at legal disadvantage by disclosing a table names like "deleted_messages", "profile_views", "single_female_users" etc. Retention of that data and user privacy suddenly becomes a topic of discussion and can cost much. You cannot always control ...


13

An interesting data point here is the DES s-box constants. Wikipedia NSA Wikipedia DES NSA recommended changes in the S-box constants to make DES resistant to differential analysis, which was unknown in the academic and commercial cryptography world at the time. In that case, they were able to make that improvement in a way that was opaque to the users of ...


12

Questions I would ask myself before using skype for sending sensitive information: Is the encryption truly end-user to end-user or is the data only encrypted between the user and Skype (thereby potentially giving Skype access)? How are IM logs managed? Can you be sure that you have 'deleted' the password from the log? Even if logs are not being stored to ...


12

I don't believe in security by obscurity in general, but in case of crypto it's actually worse, because it violates Kerckhoffs Principle So is it better? Maybe. Is it different? Sure. Is it necessary to hide the algos? If your crypto was good to begin with, you would not need to hide the algorithms, just the keys. On the other hand, you have the 'many ...


12

If you're going to distribute a secret algorithm, why not just distribute one-time pads instead? It's more secure. If you don't like the idea of one-time pads because too much data is moving over the wire, then why are you assuming that the attacker only has one cyphertext? Assuming somebody only has one cyphertext, and doesn't have the algorithm, (two ...


12

A public IP address is called a public IP address for a reason. Treat it like one. Keeping the list of public IP addresses belonging to your company will make no difference to any sort of attacks, be it opportunistic or targeted. If your system is connected to the internet, it will be hammered on by automated scripts and malware out there. If an attacker is ...


12

I think that the term "security through obscurity" gets misused quite often. The most frequently referred to quote when talking about security through obscurity is Kerckhoffs's principle. It must not be required to be secret, and it must be able to fall into the hands of the enemy without inconvenience; Security through obscurity is referring to ...


11

This is commonly called "Security by Obscurity". I think you're aiming for some form of Challenge-Response protocol, but this is so trivially weak it's ridiculous. Don't even call it security... The "Obscurity" aspect here is that the total security of the entire mechanism rests on the fact that the attacker has no idea what this mechanism is. The moment ...


11

Non-broadcast wireless networks aren't inherently less secure, but they're not more secure either. Hiding your wireless network (not broadcasting its SSID) doesn't make your network actually hidden as there are many tools that can help you find "hidden" networks, such as Kismet and inSSIDer. If configured to do so, Windows Vista and Windows 7 will have to ...


10

In security, attacks are generally divided into two categories: Opportunist attacks and targeted attacks. The former are generally low-effort and low intelligence (ie, no specific information or recon on the target), the latter have to be assumed to be motivated, well-equipped, and intelligent. The broader issue behind this question is: Does obscurity do ...



Only top voted, non community-wiki answers of a minimum length are eligible