Reputation
18,467
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
Badges
13 71 136
Impact
~867k people reached

2d
reviewed Close Unable to encrypt and decrypt text using RSA key created out of PRIVATEKEYBLOB
2d
reviewed Close Windows (object) Auditing via GPO
Feb
5
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@alexw Arguably, yes. But without a key of some form - which will, almost invariably and inevitably, be human-reproducible with sufficient knowledge and skill - there is no way for anyone to access the system without allowing everyone to access the system. Therefore the system could be fully secure for CI, but completely fail A. Or it will exceed A and therefore fail CI. (From the "CIA triad".) Another common paraphrasing of Kerckoff's Principle specifically exempts keys (of which passwords are one type): "A system should remain secure, even if the enemy knows everything except the key."
Feb
5
awarded  Nice Question
Feb
4
reviewed Close how to fix deb command not found in kali linux 2016?
Feb
4
reviewed Close What can go wrong when allowing file uploads on a web server?
Feb
4
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@Kos There. Semi-fixed it. Still no longer a direct quote, but at least there's a sentence in there that it roughly maps to as a paraphrase.
Feb
4
revised My school wants to keep the details of our door authentication system a secret. Is that a good idea?
added 36 characters in body
Feb
4
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@Nanoc See multiple comments in this thread, and the chunks that have been moved to chat. (And please post further discussion in one of those chat rooms.) Publicizing only makes the design more available to other people. It doesn't guarantee that those people will actually review it, or what their level of competency is in doing so. More importantly, you also have no guarantee of their intentions.
Feb
4
awarded  Great Answer
Feb
3
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
This answer is very flawed in that it assumes publicizing the design will increase the number of people who are reviewing it, and who are both non-hostile and competent. It certainly makes the system more accessible to review by many people. But you cannot know how many people actually will bother to review it. Or how many of those people will even be knowledgeable, skillful, and thorough enough in their review to find any flaws. Or what the intentions will be of the people who do find flaws.
Feb
3
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
If an enemy-exploitable flaw is found in the tanks, your combat effectiveness is only really compromised if the enemy in fact knows of the flaw. While Kerckoff says you have to assume this is possible, actually having the designs of the tanks public means you have to assume this is likely. Meanwhile, the timeline to come up with a fix or workaround for such flaws - then recall and upgrade/replace the fleet - will likely be measured in months.
Feb
3
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@JoãoPortela The risk to any design, in its current implementation, can only be increased by publishing details of that design. Tank armor is really a great analogy, albeit using camouflage as the obscurity layer in the analogy might not be best. Consider a nation already at war. Their tanks are deployed at the front lines in active combat. With open-source design, the enemy has practically equal information as you do when it comes to finding flaws in the tanks' construction or the armor's chemistry. And it's very possible that the enemy could dedicate more resources to finding them.
Feb
3
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
Maybe in the question of "Is adding obscurity" you should change "adding" for "enforcing". If a single person designs a systems solely in their head, the design is naturally obscure without any additional effort. Even after the designer has documented the system in detail, the design remains reasonably obscure with practically zero additional effort so long as it remains solely within the designer's possession. Putting the design in a shared-access repository, however, threatens (but does not automatically break) the obscurity of the system. That's when effort is needed to enforce it.
Feb
3
revised My school wants to keep the details of our door authentication system a secret. Is that a good idea?
added 57 characters in body
Feb
3
revised My school wants to keep the details of our door authentication system a secret. Is that a good idea?
deleted 9 characters in body
Feb
3
awarded  Good Answer
Feb
2
awarded  Nice Answer
Feb
2
answered My school wants to keep the details of our door authentication system a secret. Is that a good idea?
Jan
29
comment How to choose a good (and easy to use) WiFi password?
@PacoHope But when you get into the 15-20 character range, you're already stretching the patience of anyone trying to enter the password on anything other than a full-size QUERTY keyboard. So, why not bump the strength up a notch anyway?