Obscurity Is a Valid Security Layer
It's good someone finally took the effort to write this up. When discussing some security by obscurity measure, other people almost invariably come up with the "security by obscurity is bad" slogan without having spent much thought on /why/ it is bad in that instance. Now this piece can be conveniently linked.Somewhat differently, sometimes security by obscurity is confused with using a proper key. For example, with most webservers you can pretty safely restrict access to a file by giving it a filename containing some key that cannot realistically be guessed. Barring other ways in which an attacker could find out about the presence of the file – which is quite easy to fuckup in some environments, and is why you shouldn't do this if you really want to be secure – someone without the key cannot access the file, and thus it shouldn't be called security by obscurity; the method is public, the key is not.