Questions tagged [obscurity]

Security through obscurity means relying on the secrecy of the design of a system to keep it secure. Kerchkoff's principle states that the security of a system should not rely only on obscurity.

Filter by
Sorted by
Tagged with
2
votes
1answer
61 views

Does there exist any exploit to read someone's old emails, but not recent emails?

The only one I can think of would be if someone exports a backup of their inbox and doesn't encrypt it for some reason. Other than that, is there any case where someone could read your emails from ...
36
votes
7answers
9k views

Is it considered bad practice to use company name as part of an SSID?

From a security perspective, is it considered bad practice to use the company name as a part of an SSID? Assuming that the company is located in a densely populated area with a lot of "competing" ...
38
votes
7answers
13k views

Is it a security vulnerability to tell a user what input characters are valid/invalid?

For input validation on a website, are there any security concerns with disclosing to the user exactly what characters are valid or invalid for a given field? CWE-200: Information Exposure says one ...
8
votes
3answers
758 views

How does Widevine, FairPlay, and other DRM's work under the hood?

I am trying to understand how DRM works under the hood. There doesn't seem to be much information about it on the web so I figured I would ask here. After some attempted research, I found it ...
0
votes
1answer
108 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
0
votes
0answers
73 views

HTTP Basic Authentication vs. obscure filename [duplicate]

I'm setting up a service which allows a single 3rd party to access a file over HTTPS. The only security mechanism the 3rd party supports is Basic Authentication. To reduce complexity, I was going to ...
1
vote
1answer
72 views

Looking for a specific quote about keys and transparent encryption implementation

I'm struggling to find a quote advising that we should be comfortable in sharing details of encryption methods and implementation with would-be attackers and the system still remain secure. The idea ...
3
votes
0answers
51 views

How are the Voyager spacecraft protected from hackers? [duplicate]

I just read https://space.stackexchange.com/questions/37980/does-the-voyager-team-use-a-wrapper-fortran77-to-python-to-transmit-current and it struck me: how does NASA prevent satellites like this to ...
1
vote
2answers
385 views

S3 Bucket Name Obscurity as Security

Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
1
vote
1answer
816 views

Is there any security advantage to hiding URL parameters?

I am building a web app that needs to be secure. Is there any security advantage to hiding path parameters? I am using Angular (I don't know if this is important). What I mean by hiding path ...
0
votes
1answer
286 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
58
votes
5answers
14k views

Is open-sourcing the code of a webapp not recommended?

How to find out what programming language a website is built in? How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off? And other Qs like these ^ . ...
7
votes
2answers
1k views

What unique device fingerprinting information can an iOS 12 or iOS 13 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
4
votes
4answers
210 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
50
votes
7answers
11k views

Doesn't the choice of encryption algorithm add entropy by itself?

Let's say someone has my encrypted data and he wants to decrypt it. People always talk about how the length of the key (e.g. 256 bits) decides about the entropy of the encryption, which totally makes ...
2
votes
4answers
174 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
3
votes
2answers
140 views

Can a URL that has no links to it be discovered? [duplicate]

Say there is a URL example.com/abunchofrandomsymbols and there are no links to it anywhere on the internet. Could it be discovered somehow? My guess is a browser like Google Chrome could report it to ...
0
votes
4answers
255 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
91
votes
10answers
21k views

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
6
votes
2answers
291 views

“Security through obscurity” is bad for security systems but good for spam detection. Why?

I was reading a request on meta Stack Exchange: A request for an informative popup before possible serial voting. It received two seemingly well-informed answers from well-informed users, and I've ...
99
votes
16answers
23k views

Security BY obscurity is horrible. Is security AND obscurity good?

Normally I preach that rolling your own custom crypto algorithm is a bad idea. But will it really hurt if it's the outermost layer though? Or will it make security worse? AES -> CipherText ->...
4
votes
0answers
2k views

What unique device fingerprinting information can an iOS 11 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
0
votes
3answers
88 views

Adding false network tools / signatures for malware defense

I was looking into implementing a security measure by adding false analysis tools / signatures on client PC's. The idea is that certain malware would scan the environment for analysis tools, and if ...
1
vote
2answers
185 views

Is *all* obscurity subject to debate? [duplicate]

I'm a beginner and reading about attitudes towards "security by obscurity." I understand that there are varying degrees of vehemence in the opposition to the use of obscurity, but I am trying to ...
3
votes
0answers
101 views

Is it a security risk to send a database primary key to an external system?

I'm registering the devices of my app users with a third-party push notification service. I need to associate each device with its user at the service so that I can target a specific user's devices ...
-1
votes
1answer
145 views

shared key random number generator with obscuring admin panel

i'm trying to make another security layer above the 2FA layer for super admin panel/login what i have in mind so far is a shared key (shared seed) to generate random guids that is created by client-...
4
votes
1answer
131 views

ASCII to HEX to obscure filenames: Is this common?

I've been learning about ethical hacking, and utilizing the wonderful resources that helpful organization like OWASP and OpenDNS have provided for learning and testing. However, I sometimes come up ...
4
votes
2answers
289 views

during ssh handshaking server introduce itself - does it improve security to change self presentation?

My Archlinux running devices does not present themselves duing ssh handshake: $ telnet 192.168.1.151 11735 Trying 192.168.1.151... Connected to 192.168.1.151. Escape character is '^]'. SSH-2.0-...
3
votes
3answers
1k views

Does mixing in keystrokes of Backspace, Arrows and Delete add any security to password typing?

It is well known that the analysis of the keyboard sound can reveal/hint at what keys were pressed when a password is typed. One could mix in wrong characters (not belonging to the password) with ...
13
votes
2answers
2k views

What unique fingerprinting information can an iOS 10 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
-3
votes
1answer
512 views

Does combining two encrypted strings secures password? [duplicate]

For example, a person having password 123456. it's MD5 is e10adc3949ba59abbe56e057f20f883e and SHA1 is 7c4a8d09ca3762af61e59520943dc26494f8941b and after joining both hashes. Which comes to be ...
43
votes
7answers
9k views

Is suggesting a correct url in a 404 page bad practice?

I'm currently writing a web application, and my client asked me if it would be possible to suggest a valid URL to the user when they accidentally write a typo in the URL bar, an example of this would ...
4
votes
1answer
306 views

Increased security from separating username and login name?

I seen this question: Does username length/complexity positively impact security? which got me thinking about usernames/passwords from a developer-aspect. If a developer for an application were to ...
30
votes
7answers
5k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries aren'...
0
votes
2answers
93 views

Can I safely store my admin scripts in a publicly available script file?

On a project I am working on I have all javascripts mixed together in all.js. I have a separate file, admin.js that contains scripts used on the admin section of the project. This file is only ...
0
votes
2answers
122 views

Using Two Different Brands of Security Tools To Block Backdoors

There's this idea of using 2 brands of firewalls both inline that is usually brought up: {Internet}<-->FW(A)<-->FW(B)<-->{Internal Network} Or using 2 algorithms: {Plain ...
108
votes
8answers
20k views

My school wants to keep the details of our door authentication system a secret. Is that a good idea?

So, I am designing a door authentication system (can't really go into more detail) for our school, so that only authenticated persons can go through a certain internal door. They hold that its inner ...
8
votes
3answers
1k views

Risk of running services on ports >1024

In a Reddit thread on securing SSH access to a Raspberry Pi, one commenter recommended running SSH on a non-standard port of 8123. Another commenter had this to say on the matter: Don't change ...
5
votes
1answer
178 views

Is reskinning work computer desktops a practical security measure?

Recently, I opened a new checking account a national US bank. The branch of this bank was very modern, and they even had a wall of screens behind the teller's desk. When I was meeting with an advisor ...
87
votes
15answers
25k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
2
votes
2answers
145 views

Are there any security benefits in deleting the private key of a https webserver after starting it?

Say you have a web server offering pages via HTTPS. After the process begins running, if you were to delete the private key, would this prevent private key recovery in case of server compromise? ...
7
votes
1answer
1k views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
1
vote
0answers
990 views

What are the best ways for an iOS 9 user to protect against device fingerprinting?

In response to this series of questions: What unique device fingerprinting information can an iOS9 app collect? and as an update to this question: What are the best practices for maintaining privacy ...
8
votes
1answer
1k views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
9
votes
1answer
261 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...
20
votes
1answer
5k views

Use of obscure URL for security [duplicate]

My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines. To access the web-...
10
votes
6answers
5k views

Why do we keep our keys secret, rather than our algorithms? [duplicate]

On almost any website that relates information about cryptography in general there is this common notion that almost all encryption/decryption algorithms should use a key as one of their inputs. The ...
26
votes
5answers
4k views

Why do “Forgotten Password?” links generally reveal usernames or registered email addresses? [duplicate]

It seems that most sites or systems will just state Invalid username or password As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
49
votes
6answers
7k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
3
votes
2answers
97 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...