It’s amazing what a difference a little bit of time can make: Two years after kicking off what looked to be a long-shot campaign to push back on the practice of shutting down server-dependent videogames once they’re no longer profitable, Stop Killing Games founder Ross Scott and organizer Moritz Katzner appeared in front of the European Parliament to present their case—and it seemed to go very well.
Digital Fairness Act: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14622-Digital-Fairness-Act/F33096034_en
Security by obscurity is a myth
No. It’s a valid tactic but needs to be part of a much broader strategy.
Absolute security is unachievable, but it is much harder to probe a black box to understand how it works than reading its entire manual.
This is not true.
And what part, exactly, is not true?
People like to think in black and white, but you’re definitely right. Having your SSH server on port 36271 will likely stop a ton of drive by attacks because they simply won’t check it. Having it only listen on IP6 would stop almost all of them because you can’t trawl the IP6 space efficiently. These are “obscurity”, but they have real benefits. The idea that “obscurity” doesn’t help is just a meme that people love to quote because it’s a great single sentence with some nice rhyming “security by obscurity”. I assume the reason it became a meme is because tons of products fully relied on obscurity; I still see it all the time. As you said, it’s all layers.
I mean really the whole thing. Security by obscurity is no security at all. Device search engines like shodan exist and seeking out specifically insecure devices becomes easier by the day.
Absolute security is achievable, but comes with costs. If I’m willing to airgap everything and never go online, only using my own code, my device will be safe.
Black box testing is MUCH harder than white box testing, especially as, and I hate to say it, AI based security scanners become better and better at identifying flaws in source code. Having more information about your target is always the first step in penetration testing, and more information is ALWAYS better.
Technically, I’d say its a stalling tactic, but yeah, by no means is it a sound, comprehensive strategy.