5

I was thinking of retagging a few questions (mainly adding tags) for security by obscurity (example)

We already have Security Theater, (or in the UK Security Theatre?), what do you think of this tag?

| |
6

If you have a question that is specifically asking about security-through-obscurity, I think it is fine to tag it as such. For instance, maybe you are asking about the effectiveness of security-through-obscurity in contexts where robust prevention is impossible (e.g., DRM). That'd be fine to tag such a question with a security-through-obscurity tag.

On the other hand, suppose you started going around to existing questions that you consider to be proposing a scheme whose security relies upon security-through-obscurity, and suppose you started adding a security-through-obscurity tag to those questions. Well, that'd be a lousy and inappropriate thing to do -- for the same reasons that it would be inappropriate to go find questions that you don't like and tag them with the tag "bad-question".

To generalize: Tags should not be used to express a judgement on the worth of a question. And the question needs to stand on its own: the title and text of the question need to fully specify what is being asked (tags should not be used to disambiguate ambiguous questions, or as a substitute for explaining what you mean in the question).

Bottom line: I don't see anything wrong with adding a "security-through-obscurity" tag, as long as you use it properly and don't misuse it.

| |
2

For some reason, it sounds like a meta-tag to me. Aren't tags supposed to be able to stand on their own? I can't think of a case where or would, if used for these purposes.

| |
1

I don't think it's a bad idea, that tag could be useful - though your specific example question was not really about security by obscurity, it was about risks from a certain mechanism (that happens to also provide obscurity in some contexts, in addition to other aspects).

That said, there already is an tag... :)

| |
0

I think a "trade-off" like tag fits all the cases for "security by obscurity" and is more versatile. Though the subjectivity of both make me uneasy.

In addition, I feel that "security-by-obscurity" is essentially a reword-this-question tag. I feel conversations regarding security by obscurity always become either a useful discussion of trade-off (a topic more specific and only related "security-by-obscurity" by personal history) or a rehashed philosophic discussion.

| |
0

From what I've read, security by (or through) obscurity is frowned upon.

From the OWASP wiki: Avoid security by obscurity

It doesn't seem like a good idea to have tags for practices that people shouldn't be using.

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .