Security through obscurity - Revision history

Rudxain: fmt

2026-05-12T03:14:41Z

fmt

← Older revision		Revision as of 03:14, 12 May 2026
Line 6:		Line 6:
	Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:		Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:

	*'''Software refactoring:''' Companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey~~()"~~ may be renamed to "f_019278~~()"~~ throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is the video game Minecraft, whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.		*'''Software refactoring:''' Companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function <code>sendKey</code> may be renamed to <code>f_019278</code> throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is the video game Minecraft, whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.

	*'''Software obfuscation:''' Companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of this obfuscation is always that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.		*'''Software obfuscation:''' Companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of this obfuscation is always that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.

Drakeula: main security. Retitle section

2025-10-11T16:01:54Z

main security. Retitle section

← Older revision		Revision as of 16:01, 11 October 2025
Line 1:		Line 1:
			{{Main\|Security}}

	'''Security through obscurity''' is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security. It also includes practices like not revealing details of a system, in the hopes that this will make it more secure. Robust review by a number of experts typically enhances security, since more flaws are found and either fixed, or more secure alternative products are sought. Security is often an afterthought, or not a priority, in products. Trying to keep people from knowing the details of security sometimes obscures known deficiencies.		'''Security through obscurity''' is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security. It also includes practices like not revealing details of a system, in the hopes that this will make it more secure. Robust review by a number of experts typically enhances security, since more flaws are found and either fixed, or more secure alternative products are sought. Security is often an afterthought, or not a priority, in products. Trying to keep people from knowing the details of security sometimes obscures known deficiencies.

	==Obscurity ~~cannot improve security~~==		==Obscurity techniques==
	Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:		Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:

Drakeula: sometimes just means not documenting/reviewing the security features

2025-09-22T02:23:43Z

sometimes just means not documenting/reviewing the security features

Sojourna: clean-up

2025-07-14T23:19:26Z

clean-up

← Older revision		Revision as of 23:19, 14 July 2025
Line 1:		Line 1:
	'''Security through obscurity''' is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.		'''Security through obscurity''' is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.

	== Obscurity ~~Cannot Improve Security~~ ==		==Obscurity cannot improve security==
	Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:		Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:

	# '''Software ~~Refactoring~~:''' ~~companies~~ may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is the video game Minecraft, whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.		* '''Software refactoring:''' Companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is the video game Minecraft, whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.
	# '''Software ~~Obfuscation~~:''' ~~companies~~ may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of this obfuscation is always that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.
	# '''Software ~~Encryption~~:''' ~~companies~~ may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it, so a reverse-engineer could obtain this key and read the program.		* '''Software obfuscation:''' Companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of this obfuscation is always that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.
	# '''Physical ~~Refactoring~~:''' ~~companies~~ may remove identifying information from physical components or change component appearance. Notably in the [[Tom Evans Audio ~~Copyright Strike~~]], identifying numbers were scraped from nearly all components to make repair more difficult. [https://www.youtube.com/@MendItMark Mend it Mark] was able to reverse engineer the entire product regardless.
	# '''Confidential ~~Schematics~~:''' ~~companies~~, like [[Apple]], may keep schematics confidential, however this will not deter someone with enough time and resources from reverse engineering a product and creating schematics of their own.		* '''Software encryption:''' Companies may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it, so a reverse-engineer could obtain this key and read the program.
	# '''Physical ~~Obfuscation~~:''' ~~companies~~ can design physical products so that they have the same functionality but are unintelligible. As an example, consider a set of scissors that can only be moved by a giant ~~[[wikipedia:Rube_Goldberg_machine~~\|Rube Goldberg ~~Machine]]~~. The scissors still cut paper but the steps taken to cut the paper is ridiculously ~~overcomplicated~~.
			* '''Physical refactoring:''' Companies may remove identifying information from physical components or change component appearance. Notably in the [[Tom Evans Audio copyright strike]], identifying numbers were scraped from nearly all components to make repair more difficult. [https://www.youtube.com/@MendItMark Mend it Mark] was able to reverse engineer the entire product regardless.

			* '''Confidential schematics:''' Companies, like [[Apple]], may keep schematics confidential, however this will not deter someone with enough time and resources from reverse-engineering a product and creating schematics of their own.

			* '''Physical obfuscation:''' Companies can design physical products so that they have the same functionality but are unintelligible. As an example, consider a set of scissors that can only be moved by a giant {{Wplink\|Rube Goldberg machine}}. The scissors still cut paper but the steps taken to cut the paper is ridiculously over-complicated.

	Ultimately, vulnerabilities will exist in functionality regardless of how a product's appearance is changed. Obscuring product information merely increases the amount of time it will take to reverse-engineer a product and does not actually provide any benefit to security.		Ultimately, vulnerabilities will exist in functionality regardless of how a product's appearance is changed. Obscuring product information merely increases the amount of time it will take to reverse-engineer a product and does not actually provide any benefit to security.

	== ~~Relation to~~ Consumer ~~Rights~~ ==		==Consumer impact==
	Sometimes, companies choose to withhold details about their products in the name of "security," and in the process, consumer rights are often taken away. These decisions make diagnosing problems and repair more difficult, making consumers lose the ability to confirm that their product functions exactly as expected rather than unexpectedly and in potentially malicious ways. These decisions can take away consumer control over the product they bought after security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short amount time.[~~https://wiki~~.~~rossmanngroup.com/wiki/Reverse_Engineering_Bambu_Connect]~~ Due to the IP protections afforded by laws ~~like~~ the [[DMCA]], which make sharing of reverse engineered solutions unlawful, the only real benefit to the company is removal of consumer rights.<ref>https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure</ref>		Sometimes, companies choose to withhold details about their products in the name of "security," and in the process, consumer rights are often taken away. These decisions make diagnosing problems and repair more difficult, making consumers lose the ability to confirm that their product functions exactly as expected rather than unexpectedly and in potentially malicious ways. These decisions can take away consumer control over the product they bought after security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short amount of time (see [[Reverse engineering Bambu Connect]]). Due to the IP protections afforded by laws such as the [[DMCA]], which make sharing of reverse engineered solutions unlawful, the only real benefit to the company is removal of consumer rights.<ref>{{Cite web \|author1=Michał Kowalczyk \|author2=q3k \|author3=Jakub Stepniewicz \|title=We've not been trained for this: life after the Newag DRM disclosure \|url=https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure \|website=Media.cc.de \|date=27 Dec 2024 \|access-date=14 Jul 2025 \|url-status=live \|archive-url=https://web.archive.org/web/20241229050551/https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure \|archive-date=29 Dec 2024}}</ref>

	== List of ~~Security Through Obscurity Instances~~ ==		==List of security through obscurity instances==
			*[[Bambu Lab Authorization Control System]] (encryption and patching through [https://github.com/sleeyax/asarmor asarmor])
			*[[Tom Evans Audio copyright strike]] (physical refactoring, confidential schematics)

	* [[Bambu Lab Authorization Control System]] (Encryption and patching through [https://github.com/sleeyax/asarmor asarmor])		==References==
	* [[Tom Evans Audio Copyright Strike]] (Physical Refactoring, Confidential Schematics)		{{Reflist}}

	~~== References ==~~
	~~<references />~~
	[[Category:Common terms]]		[[Category:Common terms]]

Mr Pollo at 22:25, 14 July 2025

2025-07-14T22:25:15Z

← Older revision		Revision as of 22:25, 14 July 2025
Line 1:		Line 1:
	~~{{irrelevant}}~~		'''Security through obscurity''' is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.
	~~[[Category:Common terms]]~~
	Security through ~~Obscurity~~ is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.

	== Obscurity Cannot Improve Security ==		== Obscurity Cannot Improve Security ==
Line 25:		Line 23:
	== References ==		== References ==
	<references />		<references />
			[[Category:Common terms]]

Mingyee: Mingyee moved page Security Through Obscurity to Security through obscurity without leaving a redirect

2025-01-23T12:38:25Z

Mingyee moved page Security Through Obscurity to Security through obscurity without leaving a redirect

← Older revision		Revision as of 12:38, 23 January 2025
(No difference)

Keith: Marking this as irrelevant - the connection to consumer protection. If another article needs to link to the concept of security through obscurity, the wikipedia page seems like a better bet https://en.wikipedia.org/wiki/Security_through_obscurity

2025-01-22T21:05:56Z

Marking this as irrelevant - the connection to consumer protection. If another article needs to link to the concept of security through obscurity, the wikipedia page seems like a better bet https://en.wikipedia.org/wiki/Security_through_obscurity

← Older revision		Revision as of 21:05, 22 January 2025
Line 1:		Line 1:
			{{irrelevant}}
	[[Category:Common terms]]		[[Category:Common terms]]
	Security through Obscurity is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.		Security through Obscurity is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.

Shingo: Added formatting and improved readability.

2025-01-20T21:36:48Z

Added formatting and improved readability.

← Older revision		Revision as of 21:36, 20 January 2025
Line 3:		Line 3:

	== Obscurity Cannot Improve Security ==		== Obscurity Cannot Improve Security ==
	Obscurity in practice is intentionally ~~changing~~ the appearance of something ~~such that~~ it ~~becomes~~ difficult to understand ~~without changing~~ its end function. ~~Obscurity~~ is ~~commonly~~ used ~~in the software development as~~ it can be ~~done~~ automatically ~~but~~ it is possible ~~for~~ obscurity ~~to be implemented~~ in hardware ~~as well~~. ~~There are many ways that companies go about doing~~ this:		Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:

	# Software Refactoring: companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is Minecraft whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.		# '''Software Refactoring:''' companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is the video game Minecraft, whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.
	# Software Obfuscation: companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of obfuscation is always ~~such~~ that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.		# '''Software Obfuscation:''' companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of this obfuscation is always that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.
	# Software Encryption: companies may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it so a reverse-engineer could obtain this key and read the program.		# '''Software Encryption:''' companies may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it, so a reverse-engineer could obtain this key and read the program.
	# Physical Refactoring: companies may remove identifying information from physical components or change component appearance. Notably in the [[Tom Evans Audio Copyright Strike]] identifying numbers were scraped from nearly all components to make repair more difficult. [https://www.youtube.com/@MendItMark Mend it Mark] was able to reverse engineer the entire product regardless.		# '''Physical Refactoring:''' companies may remove identifying information from physical components or change component appearance. Notably in the [[Tom Evans Audio Copyright Strike]], identifying numbers were scraped from nearly all components to make repair more difficult. [https://www.youtube.com/@MendItMark Mend it Mark] was able to reverse engineer the entire product regardless.
	# Confidential Schematics: companies, like [[Apple]] may keep schematics confidential~~. This~~ will ~~never stop~~ someone with enough time and resources from reverse engineering a product and creating schematics of their own.		# '''Confidential Schematics:''' companies, like [[Apple]], may keep schematics confidential, however this will not deter someone with enough time and resources from reverse engineering a product and creating schematics of their own.
	# Physical Obfuscation: companies can design physical products ~~such~~ that they have the same functionality but are unintelligible. As an example, consider a set of scissors that can only be moved by a giant [[wikipedia:Rube_Goldberg_machine\|Rube Goldberg Machine]]. The scissors still cut paper but the steps taken to cut the paper is ridiculously overcomplicated.		# '''Physical Obfuscation:''' companies can design physical products so that they have the same functionality but are unintelligible. As an example, consider a set of scissors that can only be moved by a giant [[wikipedia:Rube_Goldberg_machine\|Rube Goldberg Machine]]. The scissors still cut paper but the steps taken to cut the paper is ridiculously overcomplicated.

	Ultimately, vulnerabilities will exist in functionality regardless of how a product's appearance is changed. Obscuring product information merely increases the amount of time it will take to reverse-engineer a product and does not actually provide any benefit to security.		Ultimately, vulnerabilities will exist in functionality regardless of how a product's appearance is changed. Obscuring product information merely increases the amount of time it will take to reverse-engineer a product and does not actually provide any benefit to security.

	== Relation to Consumer Rights ==		== Relation to Consumer Rights ==
	Sometimes, companies choose to withhold details about their products in the name of "security"~~. In~~ the process, consumer rights are often taken away. These decisions make diagnosing problems ~~more difficult~~ and repair more ~~challenging. In addition~~, consumers lose the ability to confirm that their product functions exactly as expected rather than in ~~unexpected and~~ potentially malicious ways. These decisions can take away consumer control over the product they bought ~~and paid for~~ after ~~the~~ security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal, instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short time. ~~See~~: ~~[[Reverse Engineering Bambu Connect~~]]. Due to the IP protections afforded by laws like the [[DMCA]], which make sharing of reverse engineered solutions unlawful, the only real benefit to the company is removal of consumer rights<ref>https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure</ref>.		Sometimes, companies choose to withhold details about their products in the name of "security," and in the process, consumer rights are often taken away. These decisions make diagnosing problems and repair more difficult, making consumers lose the ability to confirm that their product functions exactly as expected rather than unexpectedly and in potentially malicious ways. These decisions can take away consumer control over the product they bought after security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short amount time.[https://wiki.rossmanngroup.com/wiki/Reverse_Engineering_Bambu_Connect] Due to the IP protections afforded by laws like the [[DMCA]], which make sharing of reverse engineered solutions unlawful, the only real benefit to the company is removal of consumer rights.<ref>https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure</ref>

	== List of Security Through Obscurity Instances ==		== List of Security Through Obscurity Instances ==

2405:8100:8000:5CA1:0:0:5EA:2DF4: Added a source

2025-01-20T19:49:55Z

Added a source

Jack Andersen: Added a new section "Obscurity Cannot Improve Security" with a more detailed explanation for why obscurity does not promote real security. Improved the "Relation to Consumer Rights" section. Added a list of instances where a companies have instantiated "Security through Obscurity". The list is very bare-bores but I figured it would be a good idea to start it.

2025-01-20T19:19:28Z

Added a new section "Obscurity Cannot Improve Security" with a more detailed explanation for why obscurity does not promote real security. Improved the "Relation to Consumer Rights" section. Added a list of instances where a companies have instantiated "Security through Obscurity". The list is very bare-bores but I figured it would be a good idea to start it.

@@ Line 1: / Line 1: @@
 [[Category:Common terms]]
 Security through Obscurity is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.
 == Relation to Consumer Rights ==
-Sometimes, companies choose to withhold details about their products in the name of "security". In the process, consumer rights are often taken away, as consumers commonly do not have control over the product they bought and paid for after the security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal, instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short time. See: [[Reverse Engineering Bambu Connect]]
+Sometimes, companies choose to withhold details about their products in the name of "security".  In the process, consumer rights are often taken away. These decisions make diagnosing problems more difficult and repair more challenging. In addition, consumers lose the ability to confirm that their product functions exactly as expected rather than in unexpected and potentially malicious ways. These decisions can take away consumer control over the product they bought and paid for after the security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal, instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short time. See: [[Reverse Engineering Bambu Connect]]

← Older revision		Revision as of 02:23, 22 September 2025
Line 1:		Line 1:
	'''Security through obscurity''' is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.		'''Security through obscurity''' is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security. It also includes practices like not revealing details of a system, in the hopes that this will make it more secure. Robust review by a number of experts typically enhances security, since more flaws are found and either fixed, or more secure alternative products are sought. Security is often an afterthought, or not a priority, in products. Trying to keep people from knowing the details of security sometimes obscures known deficiencies.

	==Obscurity cannot improve security==		==Obscurity cannot improve security==
	Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:		Obscurity in practice involves intentionally altering the appearance of something to make it difficult to understand, while keeping its end function unchanged. In software development, obscurity is often used because it can be implemented automatically, however it is also possible to apply obscurity in hardware. Companies use various methods to achieve this, such as:

	* '''Software refactoring:''' Companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is the video game Minecraft, whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.		*'''Software refactoring:''' Companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is the video game Minecraft, whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.

	* '''Software obfuscation:''' Companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of this obfuscation is always that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.		*'''Software obfuscation:''' Companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of this obfuscation is always that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.

	* '''Software encryption:''' Companies may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it, so a reverse-engineer could obtain this key and read the program.		*'''Software encryption:''' Companies may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it, so a reverse-engineer could obtain this key and read the program.

	* '''Physical refactoring:''' Companies may remove identifying information from physical components or change component appearance. Notably in the [[Tom Evans Audio copyright strike]], identifying numbers were scraped from nearly all components to make repair more difficult. [https://www.youtube.com/@MendItMark Mend it Mark] was able to reverse engineer the entire product regardless.		*'''Physical refactoring:''' Companies may remove identifying information from physical components or change component appearance. Notably in the [[Tom Evans Audio copyright strike]], identifying numbers were scraped from nearly all components to make repair more difficult. [https://www.youtube.com/@MendItMark Mend it Mark] was able to reverse engineer the entire product regardless.

	* '''Confidential schematics:''' Companies, like [[Apple]], may keep schematics confidential, however this will not deter someone with enough time and resources from reverse-engineering a product and creating schematics of their own.		*'''Confidential schematics:''' Companies, like [[Apple]], may keep schematics confidential, however this will not deter someone with enough time and resources from reverse-engineering a product and creating schematics of their own.

	* '''Physical obfuscation:''' Companies can design physical products so that they have the same functionality but are unintelligible. As an example, consider a set of scissors that can only be moved by a giant {{Wplink\|Rube Goldberg machine}}. The scissors still cut paper but the steps taken to cut the paper is ridiculously over-complicated.		*'''Physical obfuscation:''' Companies can design physical products so that they have the same functionality but are unintelligible. As an example, consider a set of scissors that can only be moved by a giant {{Wplink\|Rube Goldberg machine}}. The scissors still cut paper but the steps taken to cut the paper is ridiculously over-complicated.

	Ultimately, vulnerabilities will exist in functionality regardless of how a product's appearance is changed. Obscuring product information merely increases the amount of time it will take to reverse-engineer a product and does not actually provide any benefit to security.		Ultimately, vulnerabilities will exist in functionality regardless of how a product's appearance is changed. Obscuring product information merely increases the amount of time it will take to reverse-engineer a product and does not actually provide any benefit to security.

	==Consumer impact==		==Consumer impact==
	Sometimes, companies choose to withhold details about their products in the name of "security," and in the process, consumer rights are often taken away. These decisions make diagnosing problems and repair more difficult, making consumers lose the ability to confirm that their product functions exactly as expected rather than unexpectedly and in potentially malicious ways. These decisions can take away consumer control over the product they bought after security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short amount of time (see [[Reverse engineering Bambu Connect]]). Due to the IP protections afforded by laws such as the [[DMCA]], which make sharing of reverse engineered solutions unlawful, the only real benefit to the company is removal of consumer rights.<ref>{{Cite web \|author1=Michał Kowalczyk \|author2=q3k \|author3=Jakub Stepniewicz \|title=We've not been trained for this: life after the Newag DRM disclosure \|url=https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure \|website=Media.cc.de \|date=27 Dec 2024 \|access-date=14 Jul 2025 \|url-status=live \|archive-url=https://web.archive.org/web/20241229050551/https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure \|archive-date=29 Dec 2024}}</ref>		Sometimes, companies choose to withhold details about their products in the name of "security," and in the process, consumer rights are often taken away. These decisions make diagnosing problems and repair more difficult, making consumers lose the ability to confirm that their product functions exactly as expected rather than unexpectedly and in potentially malicious ways. These decisions can take away consumer control over the product they bought after security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short amount of time (see [[Reverse engineering Bambu Connect]]). Due to the intellectual property (IP) protections afforded by laws such as the Digital Millennium Copyright Act ([[DMCA]]), which make sharing of reverse engineered solutions unlawful, the only real benefit to the company is removal of consumer rights.<ref>{{Cite web \|author1=Michał Kowalczyk \|author2=q3k \|author3=Jakub Stepniewicz \|title=We've not been trained for this: life after the Newag DRM disclosure \|url=https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure \|website=Media.cc.de \|date=27 Dec 2024 \|access-date=14 Jul 2025 \|url-status=live \|archive-url=https://web.archive.org/web/20241229050551/https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure \|archive-date=29 Dec 2024}}</ref>

	==List of security through obscurity instances==		==List of security through obscurity instances==

← Older revision		Revision as of 19:49, 20 January 2025
Line 5:		Line 5:
	Obscurity in practice is intentionally changing the appearance of something such that it becomes difficult to understand without changing its end function. Obscurity is commonly used in the software development as it can be done automatically but it is possible for obscurity to be implemented in hardware as well. There are many ways that companies go about doing this:		Obscurity in practice is intentionally changing the appearance of something such that it becomes difficult to understand without changing its end function. Obscurity is commonly used in the software development as it can be done automatically but it is possible for obscurity to be implemented in hardware as well. There are many ways that companies go about doing this:

	# Software Refactoring: companies may refactor computer code in production by renaming values from human intelligible to machine ~~intellgible~~. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is Minecraft whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.		# Software Refactoring: companies may refactor computer code in production by renaming values from human intelligible to machine intelligible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is Minecraft whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.
	# Software Obfuscation: companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of obfuscation is always such that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.		# Software Obfuscation: companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of obfuscation is always such that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.
	# Software Encryption: companies may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it so a reverse-engineer could obtain this key and read the program.		# Software Encryption: companies may provide software in an encrypted format that must be decrypted before running. A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it so a reverse-engineer could obtain this key and read the program.
Line 15:		Line 15:

	== Relation to Consumer Rights ==		== Relation to Consumer Rights ==
	Sometimes, companies choose to withhold details about their products in the name of "security". In the process, consumer rights are often taken away. These decisions make diagnosing problems more difficult and repair more challenging. In addition, consumers lose the ability to confirm that their product functions exactly as expected rather than in unexpected and potentially malicious ways. These decisions can take away consumer control over the product they bought and paid for after the security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal, instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short time. See: [[Reverse Engineering Bambu Connect]]		Sometimes, companies choose to withhold details about their products in the name of "security". In the process, consumer rights are often taken away. These decisions make diagnosing problems more difficult and repair more challenging. In addition, consumers lose the ability to confirm that their product functions exactly as expected rather than in unexpected and potentially malicious ways. These decisions can take away consumer control over the product they bought and paid for after the security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal, instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short time. See: [[Reverse Engineering Bambu Connect]]. Due to the IP protections afforded by laws like the [[DMCA]], which make sharing of reverse engineered solutions unlawful, the only real benefit to the company is removal of consumer rights<ref>https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure</ref>.

	== List of Security Through Obscurity Instances ==		== List of Security Through Obscurity Instances ==
Line 21:		Line 21:
	* [[Bambu Lab Authorization Control System]] (Encryption and patching through [https://github.com/sleeyax/asarmor asarmor])		* [[Bambu Lab Authorization Control System]] (Encryption and patching through [https://github.com/sleeyax/asarmor asarmor])
	* [[Tom Evans Audio Copyright Strike]] (Physical Refactoring, Confidential Schematics)		* [[Tom Evans Audio Copyright Strike]] (Physical Refactoring, Confidential Schematics)

			== References ==
			<references />