alt Hacker News"Security through obscurity" can help in the reverse (for a time) — if they have your keys but haven’t found the locks.
Might give you enough time to change the locks. But not provably — which can matter to a lot of people.
"Security through obscurity" can help in the reverse (for a time) — if they have your keys but haven’t found the locks.
Might give you enough time to change the locks. But not provably — which can matter to a lot of people.
The example in the article is more likely. Changing the name of a DB table from the default helps because any low quality probe script will break as soon as this assumption of default errors. It means that low effort, low tech, low talent attacks will fail. This is not a bad thing because these are likely to be the most common kinds of attacks.
Again, I'm not opposed to simple tricks like this to “buy some time” so long as they don’t PREVENT the deeper layers of security from being performed. But if a company has scarce resources and a choice between patching unpatched software or changing DB names from the defaults the former actually improves security and the latter should only be performed if the staff has solved all of the higher risk items.