> A password or a private key are security by obscurity.

No, they're not. You could think that if you're trying to guess what the term means, but it means something specific that is the opposite of basing your security on a specific secret that is decoupled from all implementation concerns.

>> Security by obscurity is the reliance on design or implementation secrecy as the main method of providing security to a system or component.

It's not that black and white. Port knocking for instance, is basically extending the password. Is the port configuration "implementation"?

You mean "it's not always black and white" and you are right. However the grandparent's case is clear-cut.

They said “it means” i.e. defining a rule. The point of my original comment is that the boundaries are fuzzy, so I wasn’t commenting on specific examples but the concept of the rule.

> Yes and no, passwords are an implementation detail.

Passwords are not an "implementation detail" unless they are hardcoded (and a hardcoded password is very arguably security by obscurity).

> There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords.

Yes, because the bank card provides some additional form of authentication, typically in the form of a chip on the card.

Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic.

You need a carefully constructed system to make the use of passwords viable.

> Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic.

The same happens with websites, have you never been locked out of a website (or had your IP temp banned) for failing too many login attempts?

Again, the reason that bank cards only require a PIN from you is that _the card_ provides the other half of the credentials.

If a bank card simply contained the equivalent of a username (say your legal name and address), then it would not use just a PIN.

The reason you can get away with a 4 digit PIN is that you can only try the PIN if you’re in physical possession of the card. And if an attacker is already in physical possession of the card, you want revoke the card in any case.

Web sites however, cannot just revoke the username - it would allow for trivial denial of service attacks. I could just enumerate all account numbers for my bank and lock out all customers. So the best that’s available is a temporary lockout, and then the attacker gets to try again.

Plus all you can lose is money (not privacy / control / data) and the CC companies take the hit as cost of doing business.

A temporary ban is just a rate limit by another name. Blocking IP’s is all well and good expect you can multiple attempts * thousands of IP’s means a 4 numeric digit password would literally always get cracked.

Security through obscurity is a great idea and works to slow down, prevent and even stop and attack from going forward for all kinds of systems whether is be an animal and their camouflage or a computer system holding PII with a vacuous name. Where the utility breaks down is when that is your ONLY means or layer of security. For example my house is hard to see from the road…so an opportunist thief might never see it and so just pass on by. But say this criminal finds my house by some fortuitous means. Well now he has to get past my locks and then the and if I am home, the bullets that may fly his way. And then he will have to try and get away before the police arrive.

All security relies on some sort of secret.

When brute force guessing of that secret in the best case gives a motivated attacker or a random person a chance of stumbling upon it, that's a failure of security by obscurity.

With passwords and private keys we can mathematically verify that brute force attacks won't work. At that point we're not relying on obscurity because we're assuming the attacker has knoweldege of everything except the secret itself.

A castle on the hill is hard to hide but also hard to approach, and requires hauling breaching tools and weaponry uphill.

In online fora, “security by obscurity” is when you disagree with someone.

In reality, it’s when the primary control used is restricted, shared knowledge. Famously back in the day if you knew a phone number and AT&T lingo, you could compromise the phone system.

In the case of a public CA, if your hostnames aren’t license plates, the names of servers may provide context useful for an attacker. They also provide an attack vector - the control panel for the CA.