Kerckhoff&#x27;s principle should be adhered to if truly secure encryption is desired; alas, then all sorts of <i>hard</i> obstacles pop up (UX becomes a SPOF, most commonly - a secret always needs to be stored somewhere, if only in the user&#x27;s head).<p>OTOH, the practical purpose of encryption is to remain unbroken for <i>long enough</i>, not to be completely unbreakable. As seen here, security-through-obscurity is practical <i>enough</i> in cases where user-obtained key material is too weak to provide enough protection using strong publicized crypto. In other words, it&#x27;s a two-part key: one is in user&#x27;s wetware, the other in phone&#x27;s hardware (as per obXKCD, it&#x27;s usually easier to attack the former).