ROT13 would stop and attacker peeking over everybody's documents, one doc per second, in search for something interesting to actually devote time and resources on.

You have to decide if the tradeoff between a thousand bot's scans and a sole eavesdropper noticing the knocking pattern and marking your host as "(incompetently) trying to hide" is really worth it.

One commenter on a previous iteration of this argument said that moving the port (not port knocking per se) made the access logs quieter, and that was reason enough for their use.

Edit: heh, same thing is going on a few comments down :)

What would you recommend?

SSH key with public key auth over VPN.

Restrict SSH access inbound to trusted networks only. Then you don't have to worry about all this hoopla.

> It's the ROT13 of defense mechanisms.

Not true. Modern port knocking is provably secure and requires network layer attacks to bypass.