Most of the "security" is in fact obscurity: here's something I know, you don't, while in order to find out what I know is unfeasible for you to compute all the possible combinations. Same goes for the "randomness" theory.