Ask HN: How did the internet discover my subdomain?

This is the most confidently incorrect post I've seen in a long time.

> “Security through obscurity” is the only security there is.

> Encryption obscures data.

I don't think you understand what "security through obscurity" means. What encryption does is literally the opposite of obscure, in this context. It is out in the open and documented. And the same with the rest of your examples.

That's not what that phrase means. That's not even what the word "obscure" means. Obscurity is trying to not draw attention to something, or keep it hidden (as in "nobody knows that it's there", not "you know that it's there but can't access it"). Encryption doesn't obscure data unless you're stretching the definition of the word beyond its useful purpose.

seriously.

Actually it’s quite correct.

"Security through obscurity" can definitely be defined in a meaningful way.

The opposite of "bad security through obscurity" is using completely public and standard mechanisms/protocols/algorithms such as TLS, PGP or pin tumbler locks. The security then comes from the keys and other secrets, which are chosen from the space permitted by the mechanism with sufficient entropy or other desirable properties.

The line is drawn between obscuring the mechanism, which is designed to have measurable security properties (cryptographic strength, enumeration prevention, lock security pins), and obscuring the keys that are essentially just random hidden information.

Obscuring the mechanism provides some security as well, sure, but a public mechanism can be publicly verified to provide security based only on secret keys.

verb: keep from being seen; conceal.

In what way is what he’s describing not obscurity?

It is about the existence or the methodology being obscured, not the contents of an encrypted message. The point of that phrase is to contrast one type of security for another. You and I can know exactly what tool was used to encrypt something, and all the mathematics behind it, but still fail to decrypt it without the requisite private key.

In every way, because context matters, and the original commenter intentionally recontextualized it just to be contrarian.

Yes that is what the word obscure means.

But the phrase “security through obscurity” is an industry term that refers to keeping things secure purely by not letting people know they exist.

In contrast with encryption, where I can tell you exactly where the encrypted data is, but you can’t access it.

Security through obscurity is hiding a bicycle in a bush and hoping no one notices it, encryption is more like locking it to a bike rack with a very good lock.

Two points:

1. Encrypted data is not hidden. You still know that there is data, it's just in a form that you can't understand. Just as difficult higher-level math isn't "obscured" from a non-mathematician (who knows that it is math, but can't decode it), encrypted data is not obscured.

2. You could make the argument that the data is actually hidden, but the fact that data is there is not hidden. This is pointless pedantry, though. It is both contrary to the way that everybody uses the word and stretches the meaning of the word to the point that it's not useful. There is a common understanding of what "Security through obscurity" means ( https://en.wikipedia.org/wiki/Security_through_obscurity ) and interpreting it far beyond that is not useful. It simply breaks down communication into annoying semantic arguments. I enjoy semantic arguments, but not tedious, pedantic ones where one person just argues that a word isn't what everybody understands it to mean.

More specifically, it's about WHAT is being obscured. "Security through obscurity" is about trying to be secure by keeping the details or mechanisms of a system secret, not the data itself.

This was explained in the third sentence of the post that you're responding to

You wouldn’t call a room behind a locked door “obscured.” Even if it’s technically correct in the most stretched definition (which I’m not convinced of), either way it’s not how people actually use the word.

Semantics. Considering this is your first comment ever and your account was made an hour ago I'll assume this is ragebait

encryption obfuscates data, as in the data is completely illegible unless you have the proper keys

> To make so confused or opaque as to be difficult to perceive or understand

https://www.thefreedictionary.com/obfuscate

obscuring data is different, it’s about hiding it from view or minimising the likelihood of it being found.

> To make dim, indistinct, or impossible to see

https://www.thefreedictionary.com/obscure

they are two wholly different actions.

—

> Tiered access controls obscure who can do what in the system.

i’ve seen plenty of examples where an access control system explicitly says what role/tier is required. access control is for “trust” management (who do we trust with what).

If we are going to go down this road, I want to call it occult security, because its sounds much more sexy, and its more accurate. you are casting spells and incantations to hide things from the world.

Actually it's just too short. To be complete, it would have to be like "security through obsurity _OF THE MECHANISM_."

Which basically means it was always a shit saying, like most fancy quips were.

Running your SSH server on port 8822 is security through obscurity.

Port knocking isn't, I don't think.