Hacker News Reader

Comment by rablackburn | Hacker News Reader

> All security is by definition obscurity.

Can you expound on this? For example, if I add a 30 second lockout after failed authentication attempts I don’t see how that comes under any non-tortured definition of “obscurity”.

View on HN

The lockout doesn't exist without the authentication system in the first place. Which exists to keep people from knowing the information. Its a subset of something that is needed for obscuring the information in the system from anyone that should not see it.

I really feel dirty trying to justify this level of nerdy pedanticness. I'm sure you can poke some holes from my off the hip internet comment if you really want to I'm not trying to be academic. I mostly fueled this comment with my distaste for that other platitude.

I think you miss the point of security through obscurity. It's not about keeping the information itself obscure (in your example login information), but rather the method. For example, your password hashing mechanism. If you have a strong password hash function, you don't need to obscure which hash function you use (otherwise, open source software couldn't even exist in certain areas). However, if your security relies on you obfuscating your broken, home-made hash function that only hashes the first three letters of the password, you're not really secure. Security through obscurity is an attempt at securing an otherwise unsecure system by hiding or disguising the implementation.

That being said, obscuring parts of an otherwise secure system is fine as an additional layer, especially if you just want to deter script kiddies that always hammer the same endpoints

yes, also add cryptographic complexity, don't think that qualifies either.

Cryptographic complexity is math if you ask me?

A hammer is not construction, it's a tool used by construction?

Reply on news.ycombinator.com