Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Security by obscurity is when you hide implementation details to improve security. Secrets are not obscurity, randomness is not obscurity.


Except that if they know you are using this technique (e.g. from snooping traffic) then it is straightforward to bypass, either by tailgating onto a recent connection attempt (if they can snoop) or just brute forcing it (they can test the whole key space in seconds).

There must be better ways to leverage long term shared secrets, recent authentication success, etc. I'd like to see something like Signal's ratchet mechanism.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: