"Security through obscurity" is bad for security systems but good for spam detection. Why?

Question

I was reading a request on meta Stack Exchange: A request for an informative popup before possible serial voting. It received two seemingly well-informed answers from well-informed users, and I've clipped out the relevant bits of the answers:

This would openly reveal the algorithms used to detect serial voting. Serial voting isn't a problem that only exists if you hit X votes but not X-1 votes. We don't know exactly the algorithm works, but imagine it was 10 votes on a single user in a week: if it warned you when you were about to do vote number 10, then anyone who wanted to manipulate votes in this way would just stop, and wait a few days until the popup stopped being shown to them.

...

The parameters of serial-vote detection are intentionally kept private. The last thing we want to do is to tell people who intentionally engage in this behavior how to avoid detection.

To me, this looks like the telltale signs of security through obscurity, and wandering around a bit it looks like the SE site also purposely obscures our spam detection logic, though Charcoal seems to provide individual spam detection reasons for debugging purposes. It also appears other big sites obscure spam detection and vote manipulation detection logic (Amazon, Steam, and Youtube so far as I can tell)

One of the first things I learned about computer security is that obscurity tends to be a bad thing and shouldn't be relied upon. Start by assuming your opponent knows your security setup and factor that into your threat model. Yet, when it comes to our spam detection tools and tools from other sites, it seems like obscurity is the cornerstone of the security measures, with the assumption that the opponent doesn't know the logic the tools are using and if they did know then the tools would be worthless. Even the Tag on this question explicitly notes that the tool should not rely only on obscurity, yet here we are.

I'm making the informed assumption that a guy with a CS bachelors isn't smarter than SE's security admins. So the question is, where's the problem with my understanding? Is there some fundamental difference in Spam detection and conventional security as it applies to Kerckhoff's principal that I'm not factoring in, even though both are designed to keep malicious users from corrupting data?

Answer 1

Security through obscurity is Always worse than an alternative which would be compliant with Kerckhoff's principal.

However, sometimes this is simply not possible. One good example of this is DRMs. With DRM, the content distributor wants to protect a content which he gives to the user. It is not possible in this case to rely on a secret key, because at some moment the user will also access this key to be able to use the content. Here the only solution is security bu obscurity. We can see though, that it never works so well. (Remember the DRMs on DVDs? it did not take long for them to be cracked...)

Your case, with spams, is similar. There is no way to implement a "secret key" scheme to detect spams... and therefore, the only remaining option is security through obscurity. Of course it is not excessively robust, but it is the best known solution as of today.

Answer 2

There is an evolutionary arms race between those who want to stop spam and those who want to profit off spam. Tactics that only work for a while are valuable if they are cheap to implement, as spam tactics change rapidly.

In addition, because spammers gain value from deploying cheap attacks in addition to sophisticated attacks, defenses that only stop unsophisticated spam, cheaply, can be a valuable first layer of defense.

That's all somewhat more relevant to traditional email and comment spam than to abusive or unwanted tactics like spam voting, though.