Yubico: Secure Hardware vs. Open Source
In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here.Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system."Youbico isn't saying that the security of the device is increased by keeping the source code secret.They say they are increasing the security by things like this: disabling user-loading of new firmware (which could be a bad actor loading bad firmware), using hardware with built-in side-channel countermeasures, and disabling JTAG ports (which could be used for key extraction).This isn't obscurity. These are some good engineering arguments. Engineering is always full of trade-offs.