I was thinking of retagging a few questions (mainly adding tags) for security by obscurity (example)

We already have Security Theater, (or in the UK Security Theatre?), what do you think of this tag?


If you have a question that is specifically asking about security-through-obscurity, I think it is fine to tag it as such. For instance, maybe you are asking about the effectiveness of security-through-obscurity in contexts where robust prevention is impossible (e.g., DRM). That'd be fine to tag such a question with a security-through-obscurity tag.

On the other hand, suppose you started going around to existing questions that you consider to be proposing a scheme whose security relies upon security-through-obscurity, and suppose you started adding a security-through-obscurity tag to those questions. Well, that'd be a lousy and inappropriate thing to do -- for the same reasons that it would be inappropriate to go find questions that you don't like and tag them with the tag "bad-question".

To generalize: Tags should not be used to express a judgement on the worth of a question. And the question needs to stand on its own: the title and text of the question need to fully specify what is being asked (tags should not be used to disambiguate ambiguous questions, or as a substitute for explaining what you mean in the question).

Bottom line: I don't see anything wrong with adding a "security-through-obscurity" tag, as long as you use it properly and don't misuse it.


For some reason, it sounds like a meta-tag to me. Aren't tags supposed to be able to stand on their own? I can't think of a case where or would, if used for these purposes.


I don't think it's a bad idea, that tag could be useful - though your specific example question was not really about security by obscurity, it was about risks from a certain mechanism (that happens to also provide obscurity in some contexts, in addition to other aspects).

That said, there already is an tag... :)


I think a "trade-off" like tag fits all the cases for "security by obscurity" and is more versatile. Though the subjectivity of both make me uneasy.

In addition, I feel that "security-by-obscurity" is essentially a reword-this-question tag. I feel conversations regarding security by obscurity always become either a useful discussion of trade-off (a topic more specific and only related "security-by-obscurity" by personal history) or a rehashed philosophic discussion.


From what I've read, security by (or through) obscurity is frowned upon.

From the OWASP wiki: Avoid security by obscurity

It doesn't seem like a good idea to have tags for practices that people shouldn't be using.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .