> But then we all implement passwords (which is just security by obscurity)
No it isn't. Security by obscurity is explicitly keeping things other than passwords and keys secret.
back
2 comments
That is not the definition at all. If I kept track of my passwords by making them the first letter of each page of various books on my bookshelves, that would be security through obscurity, because, while if someone who broke into my home knew about my system, it would be quite easy to extract all my passwords, but if they didn't know about my system, they would be looking forever for a notebook with cryptic letters in it, or sticky notes on the monitor, etc.
I feel like it's a pretty weak point to say that passwords and keys would be security by obscurity if we didn't carve out a special exception for them. Why do they get a special exception? Because they're really really hard to guess, not because they're fundamentally different.
Let me give a real-life example of a good non-password, non-key piece of secret information that's used for authentication. If you need to recover a WoW account that you've lost access to the customer service reps will ask you to tell them the names of the characters on the account. Your account name isn't secret, and your character names aren't secret. But the relationship is because they aren't ever publicly connected. The odds that someone other than the account owner having this information is low and the odds of guessing it by chance is impossible.
Security by obscurity refers to obscuring the design of a system, not obscuring credentials.
Hiding your password isn't security through obscurity. Hiding the fact that you need to say a password to get into a building is.
Protecting your encryption keys isn't security through obscurity. Hiding which encryption algorithm you are using is.
They're verifiably hard to guess. That is fundamentally different.
(At least when passwords are generated with enough entropy.)
But does that make them different or are they just things that are easy to verify? If you could calculate the entropy of another authentication scheme would it be included?
The danger of security by obscurity is that your system might not have as much entropy as you initially estimate and can be easily defeated. Sounds a lot like the vulnerabilities in normal crypo applications, right?
Except this is the kind of thing that you can get around if you know the person and/or the account.