Re:Security by obscurity is underrated
by gowld on Friday September 11, 2020 @02:28PM
(#24445797)
How so?
Stack cookies and ASLR are a form of encryption, where an attacker had to guess a random number to succeed in an attack.
Obscurity really just boils down to a secret that doesn't have mathematical guarantees. It's doing something that you think the attacker won't guess, just like an encryption key, but without the mathematically certified threat model, so you just hole that the attacker is using a favorable probability distribuy for their guesses
Re:Security by obscurity is underrated
by dfox on Friday September 11, 2020 @02:47PM
(#24446041)
The attacker who had already compromised the integrity of the system in question has to guess or probe for a random number with relatively low entropy in order to do something useful and straightforward with that already compromised system.
Obscurity really just boils down to a secret that doesn't have mathematical guarantees. It's doing something that you think the attacker won't guess, just like an encryption key, but without the mathematically certified threat model, so you just hole that the attacker is using a favorable probability distribuy for their guesses