Tuesday, April 17, 2007
Security by Obscurity vs Security with Obscurity ...
I read this paper here called "Security and Obscurity." It was presented to me as "controversial," I tried really hard to find controversy, but failed to do so :-) I think it states the obvious - security BY obscurity - sucks; security WITH obscurity - works wonders ...
Subscribe to:
Post Comments (Atom)
Dr Anton Chuvakin
3 comments:
Anton,
I'm disappointed. There are plenty of cases where security by obscurity works. You just have to know when it's appropriate. Public software is generally inappropriate. Pirate treasure? Generally an appropriate use of SbO.
http://clusty.com/search?input-form=clusty-simple&v%3Asources=webplus&query=blackbeard%27s+treasure
Hmmm, "disappointed", why? I did say that it works.
I've been following the thread on SecurityBasics mainly between Daniel Miessler and Craig Wright.
Alex - you've missed the original author's intent - his contention is that security BY obscurity is a bad idea but security controls WITH obscurity can potentially be useful.
And your example of Pirate Treasure is a particularly obvious example of why SbO is a bad idea. If you, as the pirate, are only relying on obscurity as the only protection for your treasure - well you're going to get robbed. Kerckhoffs' principle (the Schneier variation), pure and simple.
I'd add shark-infested waters, a tribe of hungry cannibals, some pits with stakes and a booby-trap or two.
Post a Comment