Hector Martin

Both passwords and obscurity rely on secrecy of some sort. So where is the line drawn between the two?

They are completely different things. Obfuscation is like giving your attacker your password, in a mangled form.

You can't crack a password if it has sufficient entropy. You can always reverse engineer obfuscation.

Which of these is more likely to be attacked? user@ssh_url.com:22, password or user@ssh_url.com:24, password

Would you use a crappy password and rely on the nonstandard port to deter attackers? That's what security *through* obscurity means.

The line is simply what is actually secure (mathematically), and what isn't. A password with sufficient entropy is secure. Not a 16-bit port

Real crypto is secure if the key is kept secret. That isn't "obscurity". Obfuscation isn't secure because you're giving out your code.

And proprietary crypto may be secure but most likely isn't because crypto is hard, and thus should be considered security through obscurity.