I was thinking of retagging a few questions (mainly adding tags) for security by obscurity (example)
We already have Security Theater, (or in the UK Security Theatre?), what do you think of this tag?
Add a comment
|
5 Answers
If you have a question that is specifically asking about security-through-obscurity, I think it is fine to tag it as such. For instance, maybe you are asking about the effectiveness of security-through-obscurity in contexts where robust prevention is impossible (e.g., DRM). That'd be fine to tag such a question with a security-through-obscurity tag.
On the other hand, suppose you started going around to existing questions that you consider to be proposing a scheme whose security relies upon security-through-obscurity, and suppose you started adding a security-through-obscurity tag to those questions. Well, that'd be a lousy and inappropriate thing to do -- for the same reasons that it would be inappropriate to go find questions that you don't like and tag them with the tag "bad-question".
To generalize: Tags should not be used to express a judgement on the worth of a question. And the question needs to stand on its own: the title and text of the question need to fully specify what is being asked (tags should not be used to disambiguate ambiguous questions, or as a substitute for explaining what you mean in the question).
Bottom line: I don't see anything wrong with adding a "security-through-obscurity" tag, as long as you use it properly and don't misuse it.
For some reason, it sounds like a meta-tag to me. Aren't tags supposed to be able to stand on their own? I can't think of a case where security-by-obscurity or obscurity would, if used for these purposes.
I don't think it's a bad idea, that tag could be useful - though your specific example question was not really about security by obscurity, it was about risks from a certain mechanism (that happens to also provide obscurity in some contexts, in addition to other aspects).
That said, there already is an obscurity tag... :)
I think a "trade-off" like tag fits all the cases for "security by obscurity" and is more versatile. Though the subjectivity of both make me uneasy.
In addition, I feel that "security-by-obscurity" is essentially a reword-this-question tag. I feel conversations regarding security by obscurity always become either a useful discussion of trade-off (a topic more specific and only related "security-by-obscurity" by personal history) or a rehashed philosophic discussion.
From what I've read, security by (or through) obscurity is frowned upon.
From the OWASP wiki: Avoid security by obscurity
It doesn't seem like a good idea to have tags for practices that people shouldn't be using.