Hacker News new | ask | show | jobs
by jperry 3114 days ago
Why would you assume it's "just security though obscurity" and not "security plus obscurity"? Or that "obscurity"" as a security measure is a tragic weakness.

This is a trap a lot of people fall into and I don't know why.

2 comments

If the compromise of the secret servers causes the entire network to go down, then that secret is a weakest link, so it's not "security plus obscurity".

I don't know much about Telegram's system, but if it is run on centralized servers, then that is a serious weakness...adversaries who have the capability to find and disrupt can exploit that so even though the communication may be end-to-end secure, the entire system however is not resilant against such attacks.

I think it's safe to assume that obscurity is not the only security feature protecting the secret servers. A good defense-in-depth strategy might include some amount of obscurity, along with other measures.
Do you really not know why? Or is the obvious answer just too offensive?