Hector Martin

Real crypto is secure if the key is kept secret. That isn't "obscurity". Obfuscation isn't secure because you're giving out your code.

And proprietary crypto may be secure but most likely isn't because crypto is hard, and thus should be considered security through obscurity.

My point on obscure ports is that they effectively increase the password bit length, increasing security. But maybe you’re saying that’s

...not obscurity, which makes sense I suppose. I just feel obscurity can be used as an additional layer in some cases.

But they don't increase the password bit length. This is the "movie password cracking" fallacy. Multiple "passwords" != one longer password.

A 16-bit constant that you crack *separately* adds negligible security to a strong password. It doesn't add 16 bits of entropy.

Passwords getting cracked character is a movie thing but in the real world additional characters are multiplicative, not additive.

Of course that doesn't mean running SSH on a nonstandard port is useless. I do it too, it cuts down on log spam. But mostly just that.