May as well get this one off my chest early, and try to keep it short and simple. I really dislike when people spit out that “security through obscurity is worthless.” I’ve read this a lot and heard it in person a lot too, but it is often misused. What is really meant is “security through obscurity alone is worthless.” Defense in depth benefits from security through obscurity. In a way, one could argue that passwords and theoretically reversible encryption is just harder-to-guess security through obscurity. The biggest benefits of security through obscurity would be twofold:
1) Eliminate a lot of the casual kiddies and scripted attacks. Running a vulnerable web server on port 1800 does not make the web server less vulnerable, but does limit all the scripts and kiddies who only look for web servers on port 80. You can at least limit your threat exposure.
2) Force determined threats into expending at least a little bit more energy and time to find the obscurities and work through or around them.
Alone, though, security through obscurity is more of a false sense of security than anything, even though the above two benefits are still there, no one should ever sit back and breatht easy by having security only through obscurity.
(Points for me to think about: Does this mean brute-forceable passwords and encryption is, in the end, worthless? Where easy passwords and DES were years ago “unbreakable” they are now accepted as flawed…as processors continue to speed up, will today’s standards eventually be scoffed at the same way? What can stand the test of time, biometrics? Or are passwords or at least encryption the standards we will always have to live with? As long as we have networks that have to communicate and trust, will there always be hashes or an exchange of keys that at some point is vulnerable?)