Search code examples
securitycomputer-science

What if security through obscurity fails?


I know that security through obscurity means that a system of any sort can be secure as long as nobody outside of its implementation group is allowed to find out anything about its internal mechanisms.

But what if someone does find it? Are there still any mechanisms build within the system that still protect the system if anyone tries to attack it? Are there any examples of systems using security through obscurity?


Solution

  • Security through obscurity refers to systems which are only secure inasmuch as their design and implementation remain a secret. This is like burying a treasure chest on a deserted island. If somebody finds a map, it's just a matter of time before your treasure gets dug up. It's typically hard to keep the design and implementation details secure when multiple parties will need access to the thing in order to use it. For personal standalone systems which do not require frequent access, security through obscurity is not a bad choice.

    However, personal standalone systems which do not require frequent access are not the kind of system computer security typically considers. Computer security typically concerns itself mostly with multi-user connected systems which are accessed all the time. In such cases, effectively concealing all the relevant implementation details is prohibitively difficult. In the treasure chest analogy, imagine if there were a thousand people who required regular access to the treasure. Aside from it being difficult to access the treasure, any bad actor has lots of opportunities to steal the map, look at the map, follow somebody to the treasure, or just trick somebody into divulging the location.

    So, what's the alternative? Imagine a safety deposit box in a vault at a large bank in the middle of a city. Everybody knows (hypothetically) everything about the security setup: there are alarm systems, cameras, guards, police, the vault itself, and then locks on the boxes. All of this can be known and still many of the attack vectors which would succeed against the buried treasure would fail this case: stealing one key would not be enough and, even if all keys were stolen, you'd still have to defeat surveillance, guards and police. Furthermore, access to the contents of the safety deposit box is relatively more convenient for end users: properly authenticated users (has ID, has key, etc.) just need to go to the (local) bank and present credentials and get access.

    The most secure systems - imagine defense systems - use a combination of these techniques. Design and implementation details are not publicly known and are actively protected. However, knowing these details does not give you a map to the treasure, just an understanding of the various other systems protecting the loot. Governments use obscurity because no (useful) system is impervious to all attacks.