Obscurity can only hurt you if you think it provides you true security and adopt weak practices. However, obscurity can help slightly as it buys you time from unknown future vulnerabilities, if you do try to maintain best practices (strong passphrases, apply security updates, use security vetted algorithms and protocols, etc). Obscurity doesn't prevent an attack from someone who has targeted you if your system is vulnerable, but it also doesn't advertise the fact you are vulnerable to the entire world.
If you had a Ruby On Rails app and advertised that and happened to be away on vacation last January, people could have run arbitrary commands on your webserver. In fact the advertisement would let attackers find you much faster than if they had to randomly guess what sort of technology stack you were running and try every random website.
Or let's say there's a zero-day weakness is found in SSH; sort of like the Debian SSH key generation issue from a few years back. People will start randomly scanning to find ssh running on port 22 on random IP addresses and then run the exploit. Sure they could do a port scan first to search for ssh, but attackers will first look for the low lying fruit. A full search would make their scan more than 10000 times slower. Hopefully by then you've patched the issue. Most random IP addresses are not going to have ssh or anything else running on them, so it makes sense for attackers to stop scanning after port 22 (and maybe a couple others 222 and 2222 and 22222 as well). If your home server doesn't respond to pings and drops all packets to ports but other than 39325, they likely will move on before finding your ssh server. That's obscurity helping you. Yes, a network eavesdropper could trivially find your port listening in on one ssh connection. But for the vast majority of attackers who targeted you randomly, they won't have observed an ssh connection by listening in on your network traffic. Furthermore, even for those attackers, 99.9% of the time you expect that your ssh configuration is secure and has no vulnerabilities.
And for the extra hassle of typing in
ssh -p 39325 -Y firstname.lastname@example.org, anyone who uses ssh frequently sets up an
~/.ssh/config file (along with
id_rsa) so they can just type
ssh foo to connect after typing their private keys passphrase. Now your config file remembers the full domain name, your user name, the port (if not 22), and any other flags. For ssh, I'll change ports if its internet facing and only I use it (my home machine, my VPS) as its a hassle to get everyone to use the same port as you. For internal multiple user stuff at work, I keep it firewalled to the outside internet and require outside access to pass through a VPN.
For the record, my VPS used to have ssh running on port 22 and got about ~10000/day bad authentication attempts (all with non-existent user names) recorded in the log files. In the latest three months of log files, I've gotten exactly zero running on a different port.