Contents
How does security by obscurity work in real life?
STO is based primarily on hiding important information and enforcing secrecy as the main security technique. By using security by obscurity, some people think they are going to minimize the risk of getting targeted by an attack. To explain how security by obscurity works, we need to look at real-life examples.
When is obscurity considered a valid security tool?
The efficacy of obscurity in operations security depends by whether the obscurity lives on top of other good security practices, or if it is being used alone. When used as an independent layer, obscurity is considered a valid security tool.
Who was an opponent of security through obscurity?
An early opponent of security through obscurity was the locksmith Alfred Charles Hobbs, who in 1851 demonstrated to the public how state-of-the-art locks could be picked.
What are the benefits of secrecy and openness?
For example, in a discussion about secrecy and openness in Nuclear Command and Control: [T]he benefits of reducing the likelihood of an accidental war were considered to outweigh the possible benefits of secrecy.
What’s the problem with using a secret URL?
The problem with secret URLs is that they can be leaked in a variety of ways. Images, Javascript, Stylesheets, and fonts can leak the URL of the webpage you are visiting.
Is the URL to IaaS portal unguessable?
The link itself is most likely unguessable (it includes what looks like an md5 hash and 2 GUIDs), but anyone with access to that URL will have unrestricted access to the IaaS portal for several hours (the link seems to expire after that time). I have tested that access via the link is not restricted to my specific IP address.
Are there any high profile cases of leaked URLs?
While you can watch your own network traffic (use the “network profile” feature in Chrome or Firefox) when loading the page to see whether the URL is leaked, the main concern is that any change in the page could introduce a leak. Two high profile cases of leaked secret URLs include Google Docs and Dropbox.