Comments on: Is Portknocking Real Security? http://danielmiessler.com/blog/is-portknocking-real-security grep understanding Sun, 29 Jan 2012 20:44:46 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: LonerVamp http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-44754 LonerVamp Tue, 03 Apr 2007 16:04:12 +0000 http://dmiessler.com/archives/1241#comment-44754 <p>Sorry, but I agree with you that security via obscurity can add to security. It is a passionate discussion sometimes, and I like to make sure all parties are aware of the difference between "security through obscurity alone" and "security through obscurity." Alone, security through obscurity can be dangerous; yes it is hidden, but it's just like hiding treasure under your porch. Someone just has to peek down there and find it.</p> <p>I think part of the problem in security is some people are hellbent on saying there is no silver bullet to security, but then turn around and complain about everything that is not a silver bullet. If it adds to security but is not the silver bullet, it's useless, broken, and stupid. It's an odd little paradox some security folks have...</p> <p>I would rather assume no security is absolute and instead put as many barriers between my crown jewels and the attackers. They need to earn it, and in the process I'm thwarting all the lesser attackers.</p> Sorry, but I agree with you that security via obscurity can add to security. It is a passionate discussion sometimes, and I like to make sure all parties are aware of the difference between “security through obscurity alone” and “security through obscurity.” Alone, security through obscurity can be dangerous; yes it is hidden, but it’s just like hiding treasure under your porch. Someone just has to peek down there and find it.

I think part of the problem in security is some people are hellbent on saying there is no silver bullet to security, but then turn around and complain about everything that is not a silver bullet. If it adds to security but is not the silver bullet, it’s useless, broken, and stupid. It’s an odd little paradox some security folks have…

I would rather assume no security is absolute and instead put as many barriers between my crown jewels and the attackers. They need to earn it, and in the process I’m thwarting all the lesser attackers.

]]> By: LonerVamp http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-247231 LonerVamp Tue, 03 Apr 2007 16:04:00 +0000 http://dmiessler.com/archives/1241#comment-247231 <p>Sorry, but I agree with you that security via obscurity can add to security. It is a passionate discussion sometimes, and I like to make sure all parties are aware of the difference between "security through obscurity alone" and "security through obscurity." Alone, security through obscurity can be dangerous; yes it is hidden, but it's just like hiding treasure under your porch. Someone just has to peek down there and find it.</p> <p>I think part of the problem in security is some people are hellbent on saying there is no silver bullet to security, but then turn around and complain about everything that is not a silver bullet. If it adds to security but is not the silver bullet, it's useless, broken, and stupid. It's an odd little paradox some security folks have...</p> <p>I would rather assume no security is absolute and instead put as many barriers between my crown jewels and the attackers. They need to earn it, and in the process I'm thwarting all the lesser attackers.</p> Sorry, but I agree with you that security via obscurity can add to security. It is a passionate discussion sometimes, and I like to make sure all parties are aware of the difference between “security through obscurity alone” and “security through obscurity.” Alone, security through obscurity can be dangerous; yes it is hidden, but it’s just like hiding treasure under your porch. Someone just has to peek down there and find it.

I think part of the problem in security is some people are hellbent on saying there is no silver bullet to security, but then turn around and complain about everything that is not a silver bullet. If it adds to security but is not the silver bullet, it’s useless, broken, and stupid. It’s an odd little paradox some security folks have…

I would rather assume no security is absolute and instead put as many barriers between my crown jewels and the attackers. They need to earn it, and in the process I’m thwarting all the lesser attackers.

]]> By: Eamon Landon http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-42904 Eamon Landon Fri, 30 Mar 2007 22:08:57 +0000 http://dmiessler.com/archives/1241#comment-42904 <p>I have to say that I gree with you about the obscurity aspect to security, it is just another layer in the onion. It's never perfect. Someone can always seem to find you, but at least you can make an effort at camoflage rather than wearing a big, pink, flashing bullseye.</p> <p>I remember reading an article on some hacker's challenge and a team wore all blue shirts and marched in with a lot of pomp. They were the first team crushed by the red team. Why? Because they stood out. Now the other teams were all slowly taken down, but my point is the one that drew the most attention was hit first.</p> <p>The argument should be whether or not you choose to use security through obscurity, like you posted the other day. Just my two cents, a little extra security doesn't hurt.</p> I have to say that I gree with you about the obscurity aspect to security, it is just another layer in the onion. It’s never perfect. Someone can always seem to find you, but at least you can make an effort at camoflage rather than wearing a big, pink, flashing bullseye.

I remember reading an article on some hacker’s challenge and a team wore all blue shirts and marched in with a lot of pomp. They were the first team crushed by the red team. Why? Because they stood out. Now the other teams were all slowly taken down, but my point is the one that drew the most attention was hit first.

The argument should be whether or not you choose to use security through obscurity, like you posted the other day. Just my two cents, a little extra security doesn’t hurt.

]]> By: Eamon Landon http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-247230 Eamon Landon Fri, 30 Mar 2007 22:08:00 +0000 http://dmiessler.com/archives/1241#comment-247230 <p>I have to say that I gree with you about the obscurity aspect to security, it is just another layer in the onion. It's never perfect. Someone can always seem to find you, but at least you can make an effort at camoflage rather than wearing a big, pink, flashing bullseye.</p> <p>I remember reading an article on some hacker's challenge and a team wore all blue shirts and marched in with a lot of pomp. They were the first team crushed by the red team. Why? Because they stood out. Now the other teams were all slowly taken down, but my point is the one that drew the most attention was hit first.</p> <p>The argument should be whether or not you choose to use security through obscurity, like you posted the other day. Just my two cents, a little extra security doesn't hurt.</p> I have to say that I gree with you about the obscurity aspect to security, it is just another layer in the onion. It’s never perfect. Someone can always seem to find you, but at least you can make an effort at camoflage rather than wearing a big, pink, flashing bullseye.

I remember reading an article on some hacker’s challenge and a team wore all blue shirts and marched in with a lot of pomp. They were the first team crushed by the red team. Why? Because they stood out. Now the other teams were all slowly taken down, but my point is the one that drew the most attention was hit first.

The argument should be whether or not you choose to use security through obscurity, like you posted the other day. Just my two cents, a little extra security doesn’t hurt.

]]> By: Daniel Miessler http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-42888 Daniel Miessler Fri, 30 Mar 2007 20:01:32 +0000 http://dmiessler.com/archives/1241#comment-42888 <p>Exactly, and it's even better than watching a sniper put on a gille suit because with portknocking the only thing they gain when the DO compromise the system is a big fat SSH login prompt. :)</p> Exactly, and it’s even better than watching a sniper put on a gille suit because with portknocking the only thing they gain when the DO compromise the system is a big fat SSH login prompt. :)

]]> By: Daniel Miessler http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-247229 Daniel Miessler Fri, 30 Mar 2007 20:01:00 +0000 http://dmiessler.com/archives/1241#comment-247229 <p>Exactly, and it's even better than watching a sniper put on a gille suit because with portknocking the only thing they gain when the DO compromise the system is a big fat SSH login prompt. :)</p> Exactly, and it’s even better than watching a sniper put on a gille suit because with portknocking the only thing they gain when the DO compromise the system is a big fat SSH login prompt. :)

]]> By: Dave http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-42850 Dave Fri, 30 Mar 2007 17:10:20 +0000 http://dmiessler.com/archives/1241#comment-42850 <p>Hi Daniel,</p> <p>You're an absolute saint for rolling around in piles of logic with people all the time. Sadly it never seems to stick to some people. They simply 'd|w'on't get it =(</p> <p>You're absolutely correct about the merit of portknocking. We argued weather it was authentication or authorization when the paper was first published, but not weather or not it was part of security. Being two, hard headed, "security by philosophy" type people, that should've been your first clue you were right about it bing valuable. For sure one of us would have been arguing that it's just a bad idea.</p> <p>This guys argument to you is that camouflage is ineffective. That all someone has to do is watch for you to put on your gille suit then follow where you move to. If someone is able to watch you do your knock sequence, you have more serious issues at hand.</p> <p>Cheers, -Dave</p> Hi Daniel,

You’re an absolute saint for rolling around in piles of logic with people all the time. Sadly it never seems to stick to some people. They simply ‘d|w’on’t get it =(

You’re absolutely correct about the merit of portknocking. We argued weather it was authentication or authorization when the paper was first published, but not weather or not it was part of security. Being two, hard headed, “security by philosophy” type people, that should’ve been your first clue you were right about it bing valuable. For sure one of us would have been arguing that it’s just a bad idea.

This guys argument to you is that camouflage is ineffective. That all someone has to do is watch for you to put on your gille suit then follow where you move to. If someone is able to watch you do your knock sequence, you have more serious issues at hand.

Cheers, -Dave

]]> By: Dave http://danielmiessler.com/blog/is-portknocking-real-security/comment-page-1#comment-247228 Dave Fri, 30 Mar 2007 17:10:00 +0000 http://dmiessler.com/archives/1241#comment-247228 <p>Hi Daniel,</p> <p>You're an absolute saint for rolling around in piles of logic with people all the time. Sadly it never seems to stick to some people. They simply 'd|w'on't get it =(</p> <p>You're absolutely correct about the merit of portknocking. We argued weather it was authentication or authorization when the paper was first published, but not weather or not it was part of security. Being two, hard headed, "security by philosophy" type people, that should've been your first clue you were right about it bing valuable. For sure one of us would have been arguing that it's just a bad idea.</p> <p>This guys argument to you is that camouflage is ineffective. That all someone has to do is watch for you to put on your gille suit then follow where you move to. If someone is able to watch you do your knock sequence, you have more serious issues at hand.</p> <p>Cheers, -Dave</p> Hi Daniel,

You’re an absolute saint for rolling around in piles of logic with people all the time. Sadly it never seems to stick to some people. They simply ‘d|w’on’t get it =(

You’re absolutely correct about the merit of portknocking. We argued weather it was authentication or authorization when the paper was first published, but not weather or not it was part of security. Being two, hard headed, “security by philosophy” type people, that should’ve been your first clue you were right about it bing valuable. For sure one of us would have been arguing that it’s just a bad idea.

This guys argument to you is that camouflage is ineffective. That all someone has to do is watch for you to put on your gille suit then follow where you move to. If someone is able to watch you do your knock sequence, you have more serious issues at hand.

Cheers, -Dave

]]>