1 |
Stewart Honsberger wrote: |
2 |
|
3 |
> I don't send anything back to any unexpected port probes because I don't |
4 |
> want to. |
5 |
> |
6 |
> Sure, to some extent it is security through obscurity, but the old |
7 |
> addage isn't entirely correct. If not for security through obscurity |
8 |
> we'd all have our PIN numbers sharpie'd on our ATM cards. |
9 |
|
10 |
Actually, keeping my PIN secret isn't security through obscurity. |
11 |
|
12 |
The idea of security without obscurity focuses on keeping the number of |
13 |
secrets at an absolute minimum. Systems designed around security through |
14 |
obscurity tend to rely on the secrecy of certain procedures or |
15 |
algorithms - once these are discovered by third parties, the security of |
16 |
the system has been reduced. |
17 |
|
18 |
Moving back to the PIN/ATM example: |
19 |
|
20 |
Ideally, your PIN should be the ONLY secret involved - the encryption |
21 |
algorithms and communication protocols could all be public. In the real |
22 |
world, this isn't feasible (eg. ATMs do not authenticate themselves to |
23 |
the card holder. If the algorithms and protocols were public, someone |
24 |
could theoretically construct a trojan ATM and collect people's PINs and |
25 |
bank cards). |
26 |
|
27 |
Cheers |
28 |
|
29 |
Andrew |
30 |
|
31 |
P.S It's a PIN, not a Personal Identification Number (PIN) Number :-) |
32 |
Sorry, but it's one of my pet hates (just like Automatic Teller Machine |
33 |
(ATM) machines). |
34 |
|
35 |
-- |
36 |
gentoo-security@g.o mailing list |