OSNews

Security: something that secures or makes safe.

Obscurity: the condition of being unknown.

Security through Obscurity (or Obsecurity): Something that secures or makes safe through the condition of being unknown.



In other words, a password, private key, system spec, or any other bit of information that if known would compromise the security of the system.

The trick is where you isolate this obscurity. You DON'T want to rely on the core system remaining obscure, because the ENTIRE system will be compromised if the secret ever gets out. You DO want passwords to be obscure because only the parts of the system a single or group of users has access to become compromised, and further security violations can be prevented by simply revoking their access.

Security relies on being able to verify the identity of someone or something, and the only two ways to achieve this are by either using difficult to guess secrets, or difficult to replicate characteristics.

In computing, it is very easy to replicate identifying information, so shared secrets are the only way to go. In the physical world, we can take advantage of the inherent difficulty of replicating certain things, and this is the form of security used by physical currency such as Dollars, and why Gold is such a useful standard.

And neither form of security is absolute. There is always a chance that a secret will be guessed, or that an identity will be replicated. All security is a matter of chance. Good security just stacks the deck in your favor.