OT: Passwords

MickeyMinniePlutoHueyLouieDeweyDonaldGoofy$acramento

Security through obscurity isn't security at all.

"Yahbut" applies. Obscurity _on_top_of_ good quality fundamentals *does* make life more difficult for the outside attacker.

Obscurity, _in_and_of_itself_, cannot be relied on to ensure security.

Obscurity, in the form of 'misdirection' especially, _can_ be effective in causing _most_ attackers to waste their efforts in a direction that _cannot_ success.

And, like those "hidden" devices that are so out in the open that damn few would ever look into, like the dummy wall receptacle "bank" with a plug running to a lamp, that works.

But without the underlying security, obscurity isn't of any use. If the underlying system is secure, the obscure has no function other than to piss off legitimate users, which will tend to reduce security (e.g. silly PW rules will tend to cause PWs to be written on Postit notes). OTOH, some obscurity will completely compromise any security that's there (e.g. the key under the third rock from the left).

In any case, a system should withstand a reasonable attack if all of the rules (and even software) is openly published. Indeed, open-kimono can improve security by exposing holes more readily. In the end, obscurity is only a thin blanket for the lack of security.