[CentOS] security by obscurity [was: CentOS VPN server for iPhone]

[Florin Andrei]

Joseph L. Casale wrote:
>> The non-standard port is a good trick,
> 
> Here's just an opinion: Security by obscurity only
> makes >you< feel good, it does nothing in reality.
> Anyone sufficiently talented to hack a service in
> order to gain root or do something useful would not
> be fooled by that. Set whatever your doing up right
> so that any false sense of security is not deemed
> necessary.

I've seen this before - when the non-standard port trick is mentioned, 
somebody usually gets up and goes "it's security by obscurity! it does 
nothing to protect you! it only gives you the fuzzies!"

I think that's a nice example of pervasive fallacious binary thinking, 
combined with an old tired slogan that by all rights should be dead by now.

First off, it's doesn't do "nothing". It does make things a bit harder 
for the attacker. Not much, but it's not zero either. It does eliminate 
a whole class of attacks actually - the mass scanbots or the most 
moronic script kiddies, which by the way represent the highest volume of 
malicious traffic on almost any public network. If I can do something to 
avoid getting 0wned by a pimple-face armed with a zero-day exploit and a 
bunch of bots scanning the Internet for standard ports, by all means 
I'll do it. I can't do this for a public server, which by definition 
must stand out in the clear; but for private-use stuff, why not if it's 
not too cumbersome for me? All I need is buy myself 24 hours of respite, 
until I get the patch, and the non-standard port may well do that for 
me. Or not. It's a gamble, yes, like everything else in the real world.

Secondly, nobody said that was the only line of defense. I do use other 
mechanisms as well. That's how security works, by wrapping your stuff in 
several layers of protection. You deploy several different measures, 
working in various ways, and hope they cover each other's holes.

Lastly, there is *absolutely no security measure* that is perfect. By 
the same token, we should not use firewalls, because they can be 
circumvented by people who are skilled enough, nor use passwords, 
because they can be guessed or brute-forced. And so on.

If a security measure doesn't make things too hard for the user and/or 
for the administrator (and it this case it doesn't, myself being one of 
the very few users and the sole admin), and it's not too expensive, then 
it should probably be used. It's one more peel added to the security 
"onion" and it's a plus, not a minus or a zero.

Ironically, exactly the people claiming to give security "advice" by 
saying this measure or another "does nothing in reality" because it's 
"security by obscurity", it's them who, in my view, show they don't 
really understand what security actually is. Brandishing a bunch of 
slogans does not equate with being knowledgeable in this field. 
Technical skills, experience, and a measure of realism and common sense 
are required instead.

You may want to read about the various cryptographic algorithms - they 
work, in essence, by "obscuring" the cleartext. The patterns are still 
there, they are just made hard to distinguish from the pseudo-noise by 
the algorithm - the better the crypto, the fainter the patterns. That's 
how some ciphertext-only attacks work, by looking for evanescent 
patterns in the sea of seeming randomness.
It's a scary thought if you spend time considering it, but in practice 
strong crypto does work to some extent. But if it's just "security by 
obscurity" should we not use crypto either?

Yes, "security by obscurity" is useless when it's alone, but it can be 
good if used appropriately and combined with various other measures. We 
should put this slogan to rest by now, it's 2009 already. Sheesh.

-- 
Florin Andrei

http://florin.myip.org/