Questions tagged [obscurity]

Security through obscurity means relying on the secrecy of the design of a system to keep it secure. Kerchkoff's principle states that the security of a system should not rely only on obscurity.

Filter by
Sorted by
Tagged with
108
votes
8answers
20k views

My school wants to keep the details of our door authentication system a secret. Is that a good idea?

So, I am designing a door authentication system (can't really go into more detail) for our school, so that only authenticated persons can go through a certain internal door. They hold that its inner ...
106
votes
15answers
10k views

At what point does something count as 'security through obscurity'?

So, I keep finding the conventional wisdom that 'security through obscurity is no security at all', but I'm having the (perhaps stupid) problem of being unable to tell exactly when something is 'good ...
99
votes
16answers
23k views

Security BY obscurity is horrible. Is security AND obscurity good?

Normally I preach that rolling your own custom crypto algorithm is a bad idea. But will it really hurt if it's the outermost layer though? Or will it make security worse? AES -> CipherText ->...
91
votes
10answers
22k views

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
88
votes
15answers
25k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
87
votes
8answers
30k views

How would one crack a weak but unknown encryption protocol?

I was reading this interesting question: Is my developer's home-brew password security right or wrong, and why? It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
58
votes
5answers
14k views

Is open-sourcing the code of a webapp not recommended?

How to find out what programming language a website is built in? How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off? And other Qs like these ^ . ...
50
votes
7answers
11k views

Doesn't the choice of encryption algorithm add entropy by itself?

Let's say someone has my encrypted data and he wants to decrypt it. People always talk about how the length of the key (e.g. 256 bits) decides about the entropy of the encryption, which totally makes ...
49
votes
6answers
7k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
48
votes
5answers
8k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
47
votes
4answers
20k views

Is publishing your public IP address a security threat?

I work for a large-ish company (thousands of employees across multiple locations). I recently needed to know what the possible public IP addresses are, so that a vendor could identify us (presumably ...
44
votes
11answers
7k views

Isn't all security “through obscurity”?

I know that one shouldn't rely on "obscurity" for their security. For example, choosing a non-standard port is not really security, but it also doesn't usually hurt to do so (and may help mitigate ...
43
votes
7answers
9k views

Is suggesting a correct url in a 404 page bad practice?

I'm currently writing a web application, and my client asked me if it would be possible to suggest a valid URL to the user when they accidentally write a typo in the URL bar, an example of this would ...
43
votes
3answers
3k views

The valid role of obscurity

That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
38
votes
7answers
13k views

Is it a security vulnerability to tell a user what input characters are valid/invalid?

For input validation on a website, are there any security concerns with disclosing to the user exactly what characters are valid or invalid for a given field? CWE-200: Information Exposure says one ...
37
votes
9answers
3k views

Use additional “password” in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com, ...
36
votes
7answers
9k views

Is it considered bad practice to use company name as part of an SSID?

From a security perspective, is it considered bad practice to use the company name as a part of an SSID? Assuming that the company is located in a densely populated area with a lot of "competing" ...
34
votes
4answers
4k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
34
votes
3answers
108k views

How risky is connecting to a hidden wireless network?

According to something I spotted something in a set of directions for connecting to a hidden wireless network from windows 8 found here (located under Step 1 > "Troubleshoot connection problems" > "...
31
votes
4answers
5k views

NSA Suite A Cryptography: Security through obscurity?

What is the opinion of scholars, cryptographers on NSA Suite A? Containing unpublished algorithms. Could it really be that much better than the published algorithms besides being obscure and not ...
30
votes
7answers
5k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries aren'...
26
votes
5answers
4k views

Why do “Forgotten Password?” links generally reveal usernames or registered email addresses? [duplicate]

It seems that most sites or systems will just state Invalid username or password As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
20
votes
5answers
3k views

Why is security through obscurity not a good option for encryption? [duplicate]

I feel like there must be a simple explanation, but I've been looking around haven't found any wholesome answers. Take for example my name is Alice and my best friend Bob and we want to communicate ...
20
votes
3answers
1k views

Should Stack Exchange be more obscure in its systems' structure?

I've noticed that Stack Exchange always reveals the detailed structure of its servers and systems (see these blog posts). And also the exact results of their tests and points of weakness (see the old ...
20
votes
1answer
5k views

Use of obscure URL for security [duplicate]

My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines. To access the web-...
19
votes
4answers
14k views

Processor microcode manipulation to change opcodes?

I had recently thought of an extreme way of implementing security by obscurity and wanted to ask you guys if it's possible. Would a person with no access to special processor documentation be able ...
19
votes
5answers
1k views

Is it alright to tell everyone your encryption information?

I have an account in an online banking system and they have the FAQ with something like this: How secure is the <Online Banking System Name>? Each page you view and any information ...
14
votes
9answers
1k views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
13
votes
2answers
2k views

What unique fingerprinting information can an iOS 10 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
12
votes
3answers
886 views

How does Widevine, FairPlay, and other DRM's work under the hood?

I am trying to understand how DRM works under the hood. There doesn't seem to be much information about it on the web so I figured I would ask here. After some attempted research, I found it ...
11
votes
5answers
4k views

Is Skype secure enough to transmit passwords?

Is it considered "secure" to send a password in a skype message and delete the message after the recipient remembered the password?
11
votes
5answers
2k views

Hiding version - valuable or just security by obscurity?

Many automatic security scanners have built in rules that alert on the presence of software version, and in many security lists version exposure to arbitrary person accessing the system is mentioned ...
11
votes
3answers
8k views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
10
votes
6answers
5k views

Why do we keep our keys secret, rather than our algorithms? [duplicate]

On almost any website that relates information about cryptography in general there is this common notion that almost all encryption/decryption algorithms should use a key as one of their inputs. The ...
10
votes
4answers
1k views

How to define security requirements to ensure that developers… do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
10
votes
1answer
964 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
9
votes
4answers
473 views

Will passphrases always be secure?

In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
9
votes
1answer
263 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...
8
votes
3answers
1k views

Risk of running services on ports >1024

In a Reddit thread on securing SSH access to a Raspberry Pi, one commenter recommended running SSH on a non-standard port of 8123. Another commenter had this to say on the matter: Don't change ...
8
votes
1answer
1k views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
7
votes
5answers
2k views

Which graphic image formats contain revision history? Does the image editing software being used matter?

It's common knowledge among graphic designers that they can rename a PDF file and import it into Illustrator and access the "layers" within the document, revealing hidden information. I don'...
7
votes
1answer
1k views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
7
votes
2answers
1k views

What unique device fingerprinting information can an iOS 12 or iOS 13 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
6
votes
2answers
294 views

“Security through obscurity” is bad for security systems but good for spam detection. Why?

I was reading a request on meta Stack Exchange: A request for an informative popup before possible serial voting. It received two seemingly well-informed answers from well-informed users, and I've ...
5
votes
5answers
257 views

Is there any security value of creatively naming folders containing sensitive files?

A friend of mine asked me if he could sign his tax returns without printing them out. While helping him, he insisted on naming the folder containing images of his signature and initials a completely ...
5
votes
4answers
971 views

Is changing default admin URLs an effective security measure?

Consider WordPress, which houses all of its admin functions in the /wp-admin/ directory. Accordingly, its admin URLs all begin with /wp-admin/. I'm wondering if it would be significantly more secure ...
5
votes
1answer
178 views

Is reskinning work computer desktops a practical security measure?

Recently, I opened a new checking account a national US bank. The branch of this bank was very modern, and they even had a wall of screens behind the teller's desk. When I was meeting with an advisor ...
5
votes
1answer
477 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
5
votes
2answers
1k views

How do I remove or anonymize file names and path that are stored in compiled .NET exe output?

When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that ...
4
votes
4answers
216 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...