IT lexicon Security Security through obscurity

Security through obscurity

Security På svenska → Updated: 2026-08-03

Relying on nobody knowing how the system works — which holds up right until somebody takes it apart.

The opposite of Kerckhoffs's principle: security resting on the design being kept secret rather than on the key. The history is unambiguous. The Crypto-1 cipher in MIFARE Classic cards, GSM's A5/1, and a long line of secret corporate protocols all held only until someone dumped the silicon or decoded the traffic, at which point the flaws turned out to be fundamental.

The nuance is that obscurity is not worthless as an additional layer. Moving SSH to another port stops no targeted attacker but removes most of the noise from the logs. The problem arises when obscurity is the only layer, and especially when it is used as an argument for avoiding review — at that point it is not protection but a way of postponing the news that the system is broken.

← Back to the lexicon