Linked Questions

20 votes
5 answers

Why is security through obscurity not a good option for encryption? [duplicate]

I feel like there must be a simple explanation, but I've been looking around haven't found any wholesome answers. Take for example my name is Alice and my best friend Bob and we want to communicate ...
Vale's user avatar
  • 303
10 votes
6 answers

Why do we keep our keys secret, rather than our algorithms? [duplicate]

On almost any website that relates information about cryptography in general there is this common notion that almost all encryption/decryption algorithms should use a key as one of their inputs. The ...
Mr Sir's user avatar
  • 175
8 votes
3 answers

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
Grzegorz's user avatar
  • 199
0 votes
2 answers

Improving security by altering size of hash strings [duplicate]

So I was thinking, if people get access somehow to your list of hashes, it's easy for them to figure out what alghoritm you used if they have 32, 40, 60 characters etc But what if you slice those ...
Alex's user avatar
  • 527
112 votes
9 answers

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering ...
Dmitri DB's user avatar
  • 1,181
44 votes
11 answers

Isn't all security "through obscurity"?

I know that one shouldn't rely on "obscurity" for their security. For example, choosing a non-standard port is not really security, but it also doesn't usually hurt to do so (and may help mitigate ...
Matt's user avatar
  • 3,252
31 votes
5 answers

NSA Suite A Cryptography: Security through obscurity?

What is the opinion of scholars, cryptographers on NSA Suite A? Containing unpublished algorithms. Could it really be that much better than the published algorithms besides being obscure and not ...
dongle26's user avatar
  • 455
32 votes
3 answers

What does "in-house hash function" mean?

In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete ...
Questioner's user avatar
  • 1,319
45 votes
3 answers

The valid role of obscurity

That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
Bell's user avatar
  • 985
11 votes
9 answers

Double encryption with home brew algorithm

Everyone says that home brew encryption is not a good idea because one day the algorithm will be known to attacker which sounds reasonable. So that seems it's main problem, on the other hand known ...
Ilya Chernomordik's user avatar
14 votes
5 answers

Hiding version - valuable or just security by obscurity?

Many automatic security scanners have built in rules that alert on the presence of software version, and in many security lists version exposure to arbitrary person accessing the system is mentioned ...
StasM's user avatar
  • 1,921
10 votes
4 answers

How to define security requirements to ensure that developers... do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
Phoenician-Eagle's user avatar
7 votes
5 answers

Unattended Disk Encryption

I have been asked to implement disk encryption on a machine that needs to be able to run unattended. The machine has two disks. The first disk has a boot partition and an OS partition, while the ...
millinon's user avatar
  • 173
3 votes
4 answers

Demonstration of how security through obscurity fails to work

I need to demonstrate that security through obscurity fails twice in the following scenario. I've a secret KEY. User A gets MessageX = SecretTransformation(KEY, SecretValue1); User B gets MessageY =...
NoobTom's user avatar
  • 157
5 votes
1 answer

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will ...
Aust's user avatar
  • 159

15 30 50 per page