Obscurity Is a Valid Security Layer

Re:Obscurity Is a Valid Security Layer by sambaynham on Tuesday October 24, 2017 @11:02AM (#15542068)

This example is good, but my problem with obscurity, especially in legacy products is this: complacence.

A product's perceived security /= a product's actual security. Obfuscation can lead to complacence, whereas transparency leads to paranoia, which is no bad thing in this domain. By adding an obfuscation layer, we give bad code a place to hide.

[ Parent | on HN ]

Re:Obscurity Is a Valid Security Layer by raesene6 on Tuesday October 24, 2017 @11:21AM (#15542218)

So to me the answer there might be to address the complacense which is the real problem and not remove obscurity ...

The idea of revealing all to improve paranoia rather sounds like the idea of attaching a sharp spike to your steering wheel to encourage safe driving :P

[ Parent | on HN ]

Re:Obscurity Is a Valid Security Layer by yellowapple on Tuesday October 24, 2017 @12:49PM (#15542996)

That idea might not actually be all that far-fetched. IIRC there have been a couple studies suggesting that some safety features on roads (e.g. safety rails, lights, etc.) might actually cause an increase in the number of car crashes because drivers become complacent and less paranoid about accidentally driving off a cliff.

[ Parent | on HN ]

Re:Obscurity Is a Valid Security Layer by pnutjam on Tuesday October 24, 2017 @12:16PM (#15542744)

It can also make maintenance more difficult, especially if there is a team with turnover involved in the maintenance.

[ Parent | on HN ]