Obscurity Is a Valid Security Layer
I&#x27;ve often felt there was an interesting discussion to have about obscurity.  It&#x27;s interesting because although the infosec community has such a strong reaction to the phrase &quot;security by obscurity&quot;, it has a very different reaction to the phrase &quot;obfuscation&quot;.<p>I&#x27;d like to propose a distinction between the two:<p>- &quot;security by obscurity&quot; would refer to the non-declaration of configuration and parameters<p>- &quot;obfuscation&quot; would refer to the deliberate fuzzing of <i>statistical</i> means by which such configuration and parameters can be discovered.<p>The distinction is admittedly fuzzy, but the idea is that &quot;security by obscurity&quot; is trivially defeated by treating the target system as a statistical problem.  If said system can be repeatedly probed, then useful information can be gleaned.  With obfuscation, one is deliberately injecting noise into the signal that the attacker is trying to analyze.<p>What do you all think?  Is this a useful distinction?  To be perfectly clear, I don&#x27;t mean to imply that obfuscation is a sufficient security mechanism, but rather:<p>1. that obfuscation is more useful than plain-old obscurity<p>2. we should understand that infosec attacks are often statistical in nature<p>Regarding point 2, I think this ends up shedding more light on what, exactly, is wrong with &quot;security by obscurity&quot; as it&#x27;s often debated.