undefined | Better HN

0 pointsjperry8y ago0 comments

Why would you assume it's "just security though obscurity" and not "security plus obscurity"? Or that "obscurity"" as a security measure is a tragic weakness.

This is a trap a lot of people fall into and I don't know why.

0 comments

em3rgent0rdr8y ago

If the compromise of the secret servers causes the entire network to go down, then that secret is a weakest link, so it's not "security plus obscurity".

I don't know much about Telegram's system, but if it is run on centralized servers, then that is a serious weakness...adversaries who have the capability to find and disrupt can exploit that so even though the communication may be end-to-end secure, the entire system however is not resilant against such attacks.

kelnos8y ago

I think it's safe to assume that obscurity is not the only security feature protecting the secret servers. A good defense-in-depth strategy might include some amount of obscurity, along with other measures.

cjhopman8y ago

Do you really not know why? Or is the obvious answer just too offensive?

j / k navigate · click thread line to collapse