Replies

All of MY systems work with SSID turned off. All the better if the hacker's system can't.

And here I thought you were being purposely obtuse. It's clear you don't know what you're talking about. First, you are actually hiding your SID thinking it gives you protection. That is funny.

Second the hacker system I'm sure will work with a non-broadcast SSID. I have one system on my home network that works for a while but then stops after a while. I later found out this was because of a hidden SSID. Yes I too used to hide the SSID years ago, before WPA was even out. Then I found out it's not really doing anything since my machine has to broadcast the SSID to talk to the WAP. I realized it wasn't doing anything of value and made me a bigger target to hackers. It's better to blend in with the heard with REAL security then to flag to the hackers that I have something to hide. Hiding the SSID is not hiding one thing. The channel is still being broadcast and can be snooped over the air.

I think we are done. If you think hiding the SSID is any type of security then you're hopeless.

Too funny. I thought I was talking to someone that knew a little bit about security and in reality it's at best a script kiddie.

I see I've been wasting my time and now actually feel like I lost a few IQ points.

Confirmed: The concept of security-in-depth has completely flown over your head. You still fail to grasp the meaning of the term. When security people say you shouldn't use "security through obscurity" they mean you shouldn't use "security SOLELY through obscurity." The bad security practice is in the latter, not the former.

For you again the basic concept: It is a BAD idea to hide your money in the wall behind the picture because you rely SOLELY on obscurity for protection. It is NOT a bad idea to put your safe behind the picture. Now obscurity is only an extra layer -- you force the thief to spend more time in the room to find the safe, but you know he will eventually find it. You RELY on the actual security mechanism of the safe for your security.

Then I found out it's not really doing anything since my machine has to broadcast the SSID to talk to the WAP. I realized it wasn't doing anything of value and made me a bigger target to hackers.

Confirmed: You don't know jack about WiFi hacking. The better wireless hacking tools don't sit around and wait (possibly for days) for your computer to re-associate with the WAP in order to grab the SSID. They spoof a disassociate request from the computer and catch the SSID that it then broadcasts to try to reassociate. But note this only works with your computer is on. You can't make a WAP disassociate where there's no association.

But okay. Remember, we were discussing the general concept of your claim: that security through obscurity isn't security. Since you are trying to take it off on a tangent of one example of many, I will make a concession in order to move this forward: Do not turn off SSID broadcast.

So to continue, do you think the following examples of security through obscurity should not be used?

MAC address filtering
Address space randomization
Changing HTTP ports
Changing HTTP response banners
Hash salts for password storage
Steganography
Moving the inetpub folder on an IIS box

The problem is you made a generalized statement about security, and that's usually a bad idea. For example, while I support many uses of security through obscurity as part of a layered approach, there is one place where I believe obscurity should almost never be used: encryption and hash algorithms.