Linked Questions

287 votes
11 answers

Why shouldn't we roll our own?

Why shouldn't we create our own security schemes? I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing. With that in mind, I'm ...
Polynomial's user avatar
  • 135k
154 votes
14 answers

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

The Jurassic Park scene referenced in the title is infamous for how ludicrous it sounds to those who are tech literate. But it also illustrates what seems to me to be a glaringly huge hole in web ...
Indigenuity's user avatar
  • 1,343
109 votes
15 answers

At what point does something count as 'security through obscurity'?

So, I keep finding the conventional wisdom that 'security through obscurity is no security at all', but I'm having the (perhaps stupid) problem of being unable to tell exactly when something is 'good ...
root's user avatar
  • 1,557
51 votes
6 answers

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
tylerl's user avatar
  • 83.6k
28 votes
10 answers

Is obfuscation worth it [closed]

There are many tools to obfuscate .NET applications. The free ones do some basic obfuscation while commercial ones seem to promise more. My question is: Is it worth to use the commercial obfuscation ...
user avatar
45 votes
3 answers

The valid role of obscurity

That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
Bell's user avatar
  • 985
3 votes
4 answers

Demonstration of how security through obscurity fails to work

I need to demonstrate that security through obscurity fails twice in the following scenario. I've a secret KEY. User A gets MessageX = SecretTransformation(KEY, SecretValue1); User B gets MessageY =...
NoobTom's user avatar
  • 157
5 votes
1 answer

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
Hashim Aziz's user avatar
1 vote
2 answers

Is *all* obscurity subject to debate? [duplicate]

I'm a beginner and reading about attitudes towards "security by obscurity." I understand that there are varying degrees of vehemence in the opposition to the use of obscurity, but I am trying to ...
Y     e     z's user avatar