Hacker News Reader

Comment by throwawaaarrgh | Hacker News Reader

"Firstly, we’ve eliminated the global brute forcers again since they scan only the common ports."

Some attackers scan all ports for hosts that are known online through some other port/service/registration. They can also observe your traffic flows at each hop.

Brute force scanning all ports on all IPs might take you a month. But after that you have all these easy targets that people don't patch because they think their server is invisible.

Putting a painting in front of a safe does not make your safe safer. Every thief knows safes are hid behind paintings.

View on HN

Whilst I agree philosophically with you, if you see a reduction on in your logs of this unwanted traffic, then it serves a purpose. And that's the point here. There is no claim that this is a good safety precaution, but the claim is that it is underrated, and at least that its worthwile to reduce some of the junk.

Its not because something isn't perfect, that it's not worth doing

Turn off logging. It will have the same effect (you won't see brute force attacks on common ports) with the same security.

You could also add 2 IPTables rules which would temporarily block all connection requests after hitting a threshold. But I guess actually stopping a brute force attack is less "cool" than changing a port number.

On what planet is being blind to attempts the same effect as a massive reduction in hits or logon attempts?

When those attempts are guaranteed to always fail because your server is properly secured, there's no reason to even care that they're happening.

>properly secured

Saying those words and imagining it is so does not make it so. Nothing is fully safe and seeing that attitude makes it even less likely it is

I agree. That said, it's clear that a culture of "obscurity is fine" is not helpful either.

From first principles, what is security through obscurity? It's literally security though something being vague, old, out of date, little known.

That can work. If your physical network is so old that nobody has a network card to plug into it, then they can't hack it. And maybe it works great most of the time. Until somebody finds an old token ring card and laptop.

The problem is, it's only as "secure" as the old school knowledge of the hacker. With an old enough blackhat, all security via obscurity becomes shallow. So as a practice, it's always defeatable.

Real security countermeasures resist all known attacks. Otherwise anything that fools a script kiddie would be valid security.

… so not this planet

I love this analogy.

One could also interpret the "safe behind painting" (common ports) as the common practice and the "safe under carpet" (shifted ports) as security through obscurity.

I think it is not economical from a statistical point of view. If an admin changed their ssh port, then they probably took other measures too.

Reply on news.ycombinator.com