That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no line delineating what you are trying to ban from apparently effective strategies.
For example - running ssh on a non-default port and port knocking are both suggested as ways of improving ssh security and both are criticised as being ineffective security through obscurity.
In this particular case both solutions reduce the visibility of the system to automated attempts. This does nothing to improve the effectiveness of ssh as a tool or reduce the need for other ssh security measures. It does provide a way of separating serious attempts from automated passers by though, which improves the manageability of the system.
- Besides manageability/effectiveness what distinctions describe the boundary between valid/invalid uses of obscurity?
- What analogies describe effective use of obscurity or draw the distinction between this and ineffective use?
- Which analogies apparently supporting the effectiveness of obscurity don't hold up and why?
- What other specific implementations are examples of the valid role of obscurity?