Hector Martin

You can't crack a password if it has sufficient entropy. You can always reverse engineer obfuscation.

Which of these is more likely to be attacked? user@ssh_url.com:22, password or user@ssh_url.com:24, password

Would you use a crappy password and rely on the nonstandard port to deter attackers? That's what security *through* obscurity means.

The line is simply what is actually secure (mathematically), and what isn't. A password with sufficient entropy is secure. Not a 16-bit port

Real crypto is secure if the key is kept secret. That isn't "obscurity". Obfuscation isn't secure because you're giving out your code.

And proprietary crypto may be secure but most likely isn't because crypto is hard, and thus should be considered security through obscurity.

My point on obscure ports is that they effectively increase the password bit length, increasing security. But maybe you’re saying that’s

...not obscurity, which makes sense I suppose. I just feel obscurity can be used as an additional layer in some cases.