Time and again I find myself in a hot discussion with others who claim that security by obscurity is a bad thing. SbO means gaining safety by hiding things. Don’t get me wrong – I love open-source software and although I have never taken a look at the Linux or Firefox source code I trust it way more than Windows and the Internet Explorer (that are even less functional). But it’s with no doubt harder to find security bugs in something that you can’t look into. Playing around with different HTML pages thus finding ways to exploit the application is surely harder with the IE than by analysing Firefox’ source code. And what about your password? You are hiding your password from me. Does it make your data safe? Or the PIN code of your credit card? Or why do people run a knockd to protect access to their servers? Those are just various degrees of security gained by keeping information to yourself. I don’t think there is much difference in whether the secret is a password or some piece of code.
In my humble opinion there are hardly any cases where security is not gained by obscurity. With PGP for example. I believe in mathematical one-way functions. My passwords are way safer in a PGP-encrypted file than by putting them into a file at /usr/lib/nobodyfindsme.so.3. And even with PGP you could argue that it’s just knowledge that someone else does not have that protects your information. But my PGP passphrase is way more complicated than my usual account password. And the private key it protects is insanely large. So I consider these to be an acceptable security measure.
The discussion arised when I received complaints that the source code of the CGIs used for mentors.debian.net was not made public. When I tidied up the code and published it finally I suddenly found a secret password in the code and quickly removed it.
mentors.debian.net hasn’t been hacked in years but now that the sources are publicly available I fear for that a tiny bit. The next projects that will be made open-source will be available publicly right from the start so that people may rather help me close security bugs. It would at least make me feel better.
There is but one argument that I would agree upon: it’s silly to rely on SbO.