Security Through Obscurity
A security philosophy that relies on concealing system implementation details, code logic, or architectural design to prevent attackers from discovering vulnerabilities. The security community widely considers it insufficient as a genuine security measure, as it violates Kerckhoffs's principle.
Timeline (last 90 days)
Security through obscurity refers to the practice of preventing attackers from discovering vulnerabilities by hiding a system's implementation details, code logic, or architectural design.
Security through obscurity violates Kerckhoffs's principle, placing the hope of protection on attackers not knowing internal details.
When designing secure systems, one should assume that attackers have access to complete source code, architectural documentation, and internal logic.
Obscurity itself is not without value and can serve as an additional layer within a defense-in-depth strategy to increase attacker costs, but it should not be the primary line of defense.
All Facts (4)
Security through obscurity refers to the practice of preventing attackers from discovering vulnerabilities by hiding a system's implementation details, code logic, or architectural design.
60%UnverifiedSecurity through obscurity violates Kerckhoffs's principle, placing the hope of protection on attackers not knowing internal details.
50%UnverifiedWhen designing secure systems, one should assume that attackers have access to complete source code, architectural documentation, and internal logic.
50%UnverifiedObscurity itself is not without value and can serve as an additional layer within a defense-in-depth strategy to increase attacker costs, but it should not be the primary line of defense.
50%