Re:Security Through Obscurity Is Not Bad
by pdpi on Sunday May 03, 2026 @08:43PM
(#48003267)
Port knocking isn't security through obscurity. Given the knowledge that you have a port knocking system in place doesn't tell me what specific sequence of knocks will open up the service I want to target. Even just a two knock sequence gives you a key with 32 bits of entropy, which makes it trivial to block attempts at bruteforcing the key.
[ Parent
| on HN ]
Re:Security Through Obscurity Is Not Bad
by ZoomZoomZoom on Sunday May 03, 2026 @09:13PM
(#48003486)
I don't see how your argument makes sense. It's all just bits of entropy in the end, be it knowing a port to connect to or a character in your key.
Yeah absolutely. That was precisely my point — Requiring a secret (be it a password or the private part of an asymmetric key) isn't security through obscurity, and finding the sequence of knocks is equivalent to finding a password of equivalent complexity.