> security by obscurity
I’ve often wondered at a more abstract level, where’s the line? A password or a private key are security by obscurity.
I’ve often wondered at a more abstract level, where’s the line? A password or a private key are security by obscurity.
No, they're not. You could think that if you're trying to guess what the term means, but it means something specific that is the opposite of basing your security on a specific secret that is decoupled from all implementation concerns.
>> Security by obscurity is the reliance on design or implementation secrecy as the main method of providing security to a system or component.
There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords.
Passwords are not an "implementation detail" unless they are hardcoded (and a hardcoded password is very arguably security by obscurity).
> There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords.
Yes, because the bank card provides some additional form of authentication, typically in the form of a chip on the card.
You need a carefully constructed system to make the use of passwords viable.
The same happens with websites, have you never been locked out of a website (or had your IP temp banned) for failing too many login attempts?
Again, the reason that bank cards only require a PIN from you is that _the card_ provides the other half of the credentials.
If a bank card simply contained the equivalent of a username (say your legal name and address), then it would not use just a PIN.
Web sites however, cannot just revoke the username - it would allow for trivial denial of service attacks. I could just enumerate all account numbers for my bank and lock out all customers. So the best that’s available is a temporary lockout, and then the attacker gets to try again.
When brute force guessing of that secret in the best case gives a motivated attacker or a random person a chance of stumbling upon it, that's a failure of security by obscurity.
With passwords and private keys we can mathematically verify that brute force attacks won't work. At that point we're not relying on obscurity because we're assuming the attacker has knoweldege of everything except the secret itself.
In reality, it’s when the primary control used is restricted, shared knowledge. Famously back in the day if you knew a phone number and AT&T lingo, you could compromise the phone system.
In the case of a public CA, if your hostnames aren’t license plates, the names of servers may provide context useful for an attacker. They also provide an attack vector - the control panel for the CA.