Security through obscurity is bad. Security AND obscurity is fine. There's a very clear distinction here.

Security through obscurity is only bad when it’s the only measure used. If proper security is also in place, it is the cherry on top.

For example, while I know that ssh bruteforcing bots won’t enter my server no matter how much they try, putting ssh on a non-standard port reduces the number of tries to zero.

I feel like nobody actually understands the real reason security through obscurity is so bad. It results in dead cryptographers. The implementor becomes the weakest link in the chain, and entities with a tolerance for violence can fix that problem.

reCAPTCHA is a great success story of security through obscurity because probably less than 100 people have reverse engineered it and much less than that have produced a working solver for it that doesn't require a headless browser. Snapchat would be another good example - almost no one is going to put in the work to understand this [0]. Most companies just half ass it though and accordingly achieve nothing with the obscurity at all besides worse performance.

[0] https://web.archive.org/web/20201128060507/https://hot3eed.g...

Kerchkoff would beg to disagree. Please do not refuse a beggar: https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

My take: Do proper security, but if you are short on time or resources, you can start with security through obscurity, to block a few percentage of attacks, and then when you have time and resources, go ahead and add the proper security measures.

I could see AI massively changing the calculus here. Its ability to hack and reverse-engineer (even obfuscated) artifacts may leave obscurity (read: not sharing code or binaries at all) as the primary security mechanism in the industry.

One thing I like about some layer of obscurity is not so much anyone directly attacking you, it's someone generically attacking you because you happened to use a common thing that someone finds a security hole with.