[rkagerer]

certain design documents such as threat models aren't public

That smells like security through obscurity (which admittedly is the status quo in the banking world).

Contrasted to approaches like Bitcoin, for which full code and whitepaper are public, and which has managed to survive every attack vector thrown at it for the last decade and a half. Not arguing for Bitcoin as money here, just highlighting the diverse approaches to security and that it shouldn't be taken as a given that hiding those details makes it more secure.

[gavinsyancey]

Fraud detection heuristics, at least, fundamentally have to rely on security through obscurity. If fraudsters know exactly what is detected as fraud, they can avoid detection.

Bitcoin gets around this by having absolutely no fraud prevention, and just saying "lol sucks for you should've been more careful"...

[DANmode]

There is fraud prevention (yes, you being careful, and more importantly, only doing transactions with parties you trust to reverse in the event of a mistake), you've just been accustomed to outsourcing this to a third party for some expected added value.

[nerevarthelame]

Using that ridiculous definition, there is no conceivable method of transaction that DOESN'T have fraud protections in place, which makes it a meaningless distinction. When people say that a system has fraud prevention methods, they obviously mean something on top of some vague notion that people shouldn't send money to people they don't trust.

[psd1]

I can't agree that Bitcoin has survived every attack vector, given the animosity over the BTC fork.

[ke88y]

LOL what? Keeping private keys private is not "security through obscurity". Or if it is then basically all security is security through obscurity.

No one is posting their private keys on github, and when they do their crypto goes poof nearly instantly. None of the exchanges publish their threat model documents. I sure as shit don't tell people where I store my private keys.

The bitcoin whitepaper and code are more analogous to the ISO standard, which is public.

[everfree]

I must have missed something. Wasn't the person you replied to talking about design documents? I don't think they suggested credentials like private keys should be public.

[patmorgan23]

Non-sequitur. OP never said anything about posting private keys publicly.

They did talk about having the entire system's source code/design publicly available.