Hector Martin

Bad analogy; in this world everyone owns a copy of the safe and can make safe-cracking robots for free and combine efforts.

Maybe having access to the same model safe, but not necessarily a copy of the safe with the same contents. That would depend on situation.

For obfuscation it's always a copy of the safe with the same contents. Otherwise there is other security involved. Obfuscation is cloneable.

Maybe we have a different understanding of what "security by obscurity" means. Consider: place an encrypted file on obscure url vs obvious

That's actually not obscurity, it's real security (akin to a password), assuming no directory listing etc.

Obviously there are potential pitfalls, but the concept is secure and putting security tokens in URLs is common practice.

Both passwords and obscurity rely on secrecy of some sort. So where is the line drawn between the two?

They are completely different things. Obfuscation is like giving your attacker your password, in a mangled form.