Security by obscurity is underrated
It seems to me that the article is missing a few of points on what &quot;security by obscurity&quot; means.<p>From Wikipedia: &quot;reliance [...] on design or implementation secrecy as _<i>the main method</i>_ of providing security [...]&quot;<p>So, to use the model mentioned in the article, a single slice of cheese. It&#x27;s not &quot;an additional layer of defense&quot;, it&#x27;s the main one (so you have other... weaker layers? ¯\_(ツ)_&#x2F;¯)<p>Second, &quot;reliance on secrecy of design and implementation&quot; is different from &quot;reliance on secrecy of _whatever-else_&quot;, because design and implementation are most often either easily discoverable (sure, occasional skids might not scan port 64323 but what about someone who can observe your traffic?) or pretty much guaranteed to be discovered by adveraries with (not even as much as one might think) time and motivation.<p>Third, some of the examples mentioned (e.g., the decoy cars) are not even security by obscurity, that&#x27;s called deception.<p>So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should <i>never</i> be your only (or your main) layer of defense.<p>Security by obscurity is not underrated, by definition it&#x27;s just bad.