Questions tagged [security-by-obscurity]

A security anti-pattern in which secure information is "protected" by making it "hard to find" in the mistaken belief that it is then secure. It is the approximate equivalent of hiding the front door key under the mat.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
47 views

php obscure email address with modifications

Sometimes my content has email addresses in it - but I want to obscure them using javascript. I have made a javascript solution for the frontend which rebuilds them but only from a certain format. ...
  • 563
0 votes
0 answers
171 views

Image Privacy: Base64 or Privacy Through Obscurity

I'm trying to find an answer to a dilemma and I'd like some suggestions. Type of app: a web app using Ruby on Rails. Issue: product owner wants to minimize access to images for privacy reasons. ...
0 votes
1 answer
198 views

Is there a way to obscure the activities with Proguard in Android?

I know that Proguard does not obscure the names of the activities that are declared in the manifest.xml. Is there anyway a way to obscure them?
  • 63
0 votes
2 answers
224 views

Drawing parts of a Blob to html canvas without data urls in Javascript

I'm testing something out using a webapp where users can see a few pieces of an image but not all of it at once. The whole data is sent down to the client and decrypted client-side. That data is then ...
  • 226
0 votes
4 answers
357 views

Rearranging characters in a 15-digit string with the ability to revert to the original string

I have numerous 15-digit numbers. I need to rearrange the digits in each string based on a set order to hide the composite identifiers. For example: convert 123456789123456 to 223134897616545 The ...
  • 345
0 votes
1 answer
31 views

Non-accessible configuration design

Due to design constrains the project I am currently working on won't allow us to write certain set of configuration parameters in plain text file such as properties files (mainly due to security ...
  • 364
0 votes
1 answer
59 views

Numerical Obscurification

Similar to this question in C#: User ID obfuscation I'm looking for a solution in VBA to obscure a long value through an encoding method and also I would need to be able to decode the number produced ...
  • 5,109
1 vote
1 answer
540 views

How Safe is an Obscure File Download Link?

Here's what I'm trying to do: I want to distribute my Vcard (.vcf) file by hosting it on my personal website (this part is a rigid requirement). People will access it from a QR code on my business ...
2 votes
2 answers
262 views

Using @ in a C or C++ application [duplicate]

I came to this obscure thing ... I would like to know if there are any possibilities for the @ sign to appear in the source of a valid C/C++ application, beside of the following situations: a const ...
  • 33.9k
1 vote
1 answer
1k views

Obfuscation of URLs - rails

I'm working on a project that's left me stumped, hoping someone out there might have some interesting input. I see there are several gems available for obfuscation of urls, but they seem to stop at ...
0 votes
1 answer
479 views

What's the optimal method to obscure String(Java - Serialization)

What's the optimal method to obscure String For learning purposes I've decided to dig in a bit more into Java Serialization, most of it is fine. However I've been coming across this weird issue when ...
  • 4,908
0 votes
0 answers
63 views

Database security encoding

I want to ask you if there are (in practice) techniques for encoding a database in such a way, that table names are arbitrary and fields are encoded(not encrypted) in some way. For example consider a ...
4 votes
5 answers
2k views

Should i obscure database primary keys (id's) in application front end

I'm working on an application which allows a moderator to edit information of user. So, at the moment, i have URL's like http://xxx.xxx/user/1/edit http://xxx.xxx/user/2/edit I'm a bit worried here, ...
0 votes
2 answers
1k views

Is there any JS library to obscure string manipulation?

I'd like to make the string manipulation as obscured as possible. Now I wrote a small function made HEX string from the original string (the length of the result is twice as the length of the ...
-3 votes
1 answer
96 views

De"compressing" Javascript [duplicate]

This will without a doubt be a duplicate, but I have no idea what else to call it. A friend of mine is trying to learn Javascript. He accidentally saved the "compressed" (all whitespace removed) ...
  • 5,722
0 votes
1 answer
402 views

Entry Point Obscuring

I've been writing an EPO program and so far I've been able to find a call opcode and get the RVA from the following address in the binary, then parse the IAT to get names of functions that are ...
  • 1,446
0 votes
2 answers
69 views

Privacy, Protection, Obscurity

I'm working on a project with a few interesting requests from the client. Wondering if anyone has any suggestions or would like to weigh in. I'm creating a Web App for my client to distribute ...
  • 3,318
3 votes
1 answer
345 views

Secure Connection to LDAP Server

I am using a hash to encrypt and decrypt my passwords which I am sending to a cass construct. Exampled below: public static function HashPassword ($Password){ $salt = self::$Salt; ...
  • 5,444
3 votes
2 answers
1k views

How to obscure hard coded password in code?

I would like to obscure a password in my VB6 code, such that it cannot be revealed even via decompilation. Is this possible?
  • 22.3k
1 vote
1 answer
405 views

OAuth Javascript: twitter, security through obscurity? Have a better approach?

Background Lets say I want to use twitter's javascript api. The twitter javascript api says Be cautious when using JavaScript with OAuth. Don't expose your keys [1]. It sounds like using ...
  • 1,274
0 votes
2 answers
777 views

What techniques are available to obscure shader assets?

I have a number of shaders in my games and apps, I currently use a simple program I made to take the shaders and generate a java class which puts the text into a StringBuilder, one char at a time, so ...
  • 53.7k
5 votes
3 answers
519 views

How to hide literals in code

What are the main existing approaches to hide the value of literals in code, so that they are not easily traced with just an hexdumper or a decompiler? For example, instead of coding this: ...
  • 27.1k
3 votes
1 answer
846 views

How to monitor user action on .NET web browser control without obfuscation?

I have embedded web browser control in WinForms app. The user makes some actions on site that doesn't belong to me. At the end (eg. on last page) I need to send confirmation to my server (eg. via web ...
  • 31
1 vote
2 answers
1k views

How to obscure Wordpress?

I am running a site using Wordpress as CMS System. Now I don't want anyone to know that this site is powered by Wordpress in the background. Is there any easy way to completely obscure Wordpress? ...
  • 131
32 votes
8 answers
3k views

Isn't a password a form of security through obscurity?

I know that security through obscurity is frowned upon and considered not really secure, but isn't a password security through obscurity? It's only secure so long as no one finds it. Is it just a ...
  • 30.6k
4 votes
2 answers
430 views

Obfuscation in .NET vs. Delphi

I have old Delphi application. This app takes session key from server, do some stuff with secret using this key like hashing etc. and post back cipher to the server. Server knows how to retrieve data ...
  • 6,109
1 vote
4 answers
1k views

Security by obscurity: what about URLs?

first of all, the question from a naive point of view: I've got a WebApplication with a URL to a product like Products?id=123. Let's say I've got an administration page reachable from Products?id=123&...
  • 4,582
3 votes
2 answers
5k views

Obscure and encode a URL parameter

I want to encrypt a URL variable so that the user can't see the information when it is passed. I've found several scripts online but none of them work. Most seem to lean toward using base-64. Could ...
  • 5,416
1 vote
8 answers
551 views

I want to use security through obscurity for the admin interface of a simple website. Can it be a problem?

For the sake of simplicity I want to use admin links like this for a site: http://sitename.com/somegibberish.php?othergibberish=... So the actual URL and the parameter would be some completely ...
user avatar
2 votes
5 answers
1k views

Is it possible to have an open source implementation of DRM software? [closed]

I am curious to know if anyone has figured out a way to create the server portion of DRM in an open source manner while allowing for DRM clients to be closed. I understand that if the client were open ...
1 vote
6 answers
3k views

The best approach to scramble CSS definitions to a human-unreadable state throughout an ASP.NET application

I'm not sure if it will bring anything beyond saving on traffic through the removal of long-worded names, but I would definitely want to hide my system of namings, declarations and their organization. ...
78 votes
14 answers
40k views

Why is security through obscurity a bad idea? [closed]

I recently came across a system where all of the DB connections were managed by routines obscured in various ways, including base 64 encoding, md5sums and various other techniques. Why is security ...
  • 24.5k
1 vote
6 answers
2k views

Masking an external URL

I need to be able to open up an external URL in my website with out revealing it to my users (both in the browser and in the source). I do not want them to be able to copy the URL and edit the query ...
  • 620
19 votes
12 answers
16k views

Is using a GUID security though obscurity?

If you use a GUID as a password for a publicly facing application as a means to gain access to a service, is this security through obscurity? I think the obvious answer is yes, but the level of ...
user avatar
62 votes
14 answers
46k views

Encrypting/Hashing plain text passwords in database [closed]

I've inherited a web app that I've just discovered stores over 300,000 usernames/passwords in plain text in a SQL Server database. I realize that this is a Very Bad Thing™. Knowing that I'll have to ...
  • 5,837