Annotated edit history of
SecurityByObscurity version 5, including all changes.
View license author blame.
| Rev |
Author |
# |
Line |
| 2 |
AristotlePagaltzis |
1 |
This is not security at all. However, it may protect you from casual attacks from the uninitiated. The aim is to making (potential) security holes hard to find, while they still exist. Common approaches include |
| 1 |
BlairHarrison |
2 |
|
| 3 |
AristotlePagaltzis |
3 |
* Using different names for the SuperUser accounts, such as bob, rather than "root" or "administrator" |
| 2 |
AristotlePagaltzis |
4 |
* Running daemons on non-standard ports. |
| 3 |
AristotlePagaltzis |
5 |
* Running obscure variants of software or hardware which neither exploits are readily available for nor much attention is paid to. |
| |
|
6 |
* Distributing software as [BinaryExecutable]s, keeping [source code closed|ClosedSource] so that it cannot easily be examined for weaknesses. |
| 4 |
PerryLorier |
7 |
|
| |
|
8 |
---- |
| |
|
9 |
The point of security is to have as much of your security public where people can comment on it and suggest improvements, and then you want to have the smallest possible part of your security secret. |
| |
|
10 |
|
| |
|
11 |
This is how encryption works. The encryption algorithm is public knowledge, and heavily researched by cryptographers. However the "key" (or "password") is kept secret. |
| |
|
12 |
|
| |
|
13 |
The other point is to have the secret be easily changed, so if it's ever compromised you can easily change it. (Or, even if it's not easily compromised you want to change it anyway). |
| |
|
14 |
|
| |
|
15 |
Security through obscurity is usually frowned upon, because the "secret" is usually larger than it has to be, and is usually obscuring huge security flaws. ("I use a new cryptographic algo I made up! Noone knows what it is, so it must be secure!"). This is often considered even *less* secure than having a well known insecure system because you trust the security more than you should. |
| |
|
16 |
|
| |
|
17 |
Much of the discussion at the top of this page isn't advocating security through obscurity. It's advocating diversity and avoiding a monoculture which is an entirely different concept. The idea behind a monoculture is that if everything is identical, then if you found a flaw in one, you've found a flaw in them all. If there is some varience between instances of a security infrastructure then you have to rediscover the flaw for each instance, which drastically slows down the attacker from compromising machines, but does not slow an attacker trying to attack any specific instance. |
| 5 |
CraigBox |
18 |
|
| |
|
19 |
----- |
| |
|
20 |
CategorySecurity |
