0

I have read this site enough that I know that security by obscurity is discouraged and bad. However, why are passwords not security by obscurity? They are an obscure piece of data that when found allow access to an account. That is what I have come to believe what security by obscurity is.

11

"Security through obscurity" usually refers to systems which violate Kerckhoffs's principle.

The key point is that it is the system itself that is obscured, or which obscures something. Secrets may still exist within that model, such as a password or a cryptographic key, but they are secrets which can't just be discovered by reverse engineering the system. Obscure things can still be discovered. Security through obscurity fails because people try to hide secrets in a box, but then give the box to someone who has the ability to get inside it, and just hope they don't try.

Another way to look at it is this: you can make a password secret and build systems where only the user knows the plaintext password, but it's (mostly) impossible to build a useful system where the code or algorithm itself is secret.

In the end, though, your question really boils down to the difference in language between "obscure" and "secret". There isn't an easy answer to this, but I would say that the effort or leverage required to expose a secret is greater than that of something simply obscure.

10

I'll refer you to this excellent answer by another user. Here's an excerpt:

You are right in that a password is only secure if it is obscure. But the "obsure" part of "security through obscurity" refers to obscurity of the system. With passwords, the system is completely open -- you know the exact method that is used to unlock it, but the key, which is not part of the system, is the unknown.

If we were to generalize, then yes, all security is by means of obscurity. However, the phrase "security through obscurity" does not refer to this.

0

I think that the key (no pun intended) is that a security-by-obscurity system obscures the same system for all users. In other words, once a user deobscures the system, everyone else can break the system.

In a password-based system, breaking one password does not allow you to break other users' accounts. You are obscuring a different item for each user of the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.