Linked Questions

1 vote
2 answers

Is *all* obscurity subject to debate? [duplicate]

I'm a beginner and reading about attitudes towards "security by obscurity." I understand that there are varying degrees of vehemence in the opposition to the use of obscurity, but I am trying to ...
Y     e     z's user avatar
0 votes
0 answers

Does "Security By Obfuscation" have any place in good security practices? [duplicate]

One thing I've had hammered into me by pretty much every security expert I've talked to is that security by obfuscation is not a substitute for actual security measures. However, it has me wondering; ...
Bitsplease's user avatar
154 votes
14 answers

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

The Jurassic Park scene referenced in the title is infamous for how ludicrous it sounds to those who are tech literate. But it also illustrates what seems to me to be a glaringly huge hole in web ...
Indigenuity's user avatar
  • 1,343
102 votes
10 answers

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
William Rosenbloom's user avatar
39 votes
7 answers

Is it a security vulnerability to tell a user what input characters are valid/invalid?

For input validation on a website, are there any security concerns with disclosing to the user exactly what characters are valid or invalid for a given field? CWE-200: Information Exposure says one ...
csrowell's user avatar
  • 487
44 votes
11 answers

Isn't all security "through obscurity"?

I know that one shouldn't rely on "obscurity" for their security. For example, choosing a non-standard port is not really security, but it also doesn't usually hurt to do so (and may help mitigate ...
Matt's user avatar
  • 3,252
46 votes
8 answers

What methods are available for securing SSH? [closed]

What methods are available for securing SSH?
Olivier Lalonde's user avatar
51 votes
6 answers

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
tylerl's user avatar
  • 83.5k
45 votes
7 answers

Port Knocking is it a good idea?

Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
Mark Davidson's user avatar
20 votes
3 answers

Should Stack Exchange be more obscure in its systems' structure?

I've noticed that Stack Exchange always reveals the detailed structure of its servers and systems (see these blog posts). And also the exact results of their tests and points of weakness (see the old ...
amyassin's user avatar
  • 475
17 votes
4 answers

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
JD Isaacks's user avatar
10 votes
6 answers

RDP Attempts From Unknown IPs, How to Protect?

I'm running Windows Server2008 R2, and seeing the following error multiple times with various IPs in the event log: The Terminal Server security layer detected an error in the protocol stream and ...
AlexVPerl's user avatar
  • 243
14 votes
5 answers

Hiding version - valuable or just security by obscurity?

Many automatic security scanners have built in rules that alert on the presence of software version, and in many security lists version exposure to arbitrary person accessing the system is mentioned ...
StasM's user avatar
  • 1,921
10 votes
4 answers

How to define security requirements to ensure that developers... do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
Phoenician-Eagle's user avatar
5 votes
6 answers

Is it safe to reveal information about the OS and the software you use?

As in what OS you use, it's version .. etc. Every time I go to the bank and I get greeted with the ATM in the following photo, this question comes to my mind.. Oh and it's still Windows XP till last ...
Ulkoma's user avatar
  • 8,793

15 30 50 per page