Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

My point is that if you set up a master key in the fashion described, such that thousands of people have access to it and it's basically impossible to change, that key becomes part of the system, rather than being a separate key. It becomes part of "how the lock works".

To quote Kerckhoffs's principle, which Wikipedia leads me to believe is the basis of the whole concept of security through obscurity:

"Its key must be communicable and retainable without the help of written notes, and changeable or modifiable at the will of the correspondents"

Despite the name, this master key is not a "key" in the cryptographic sense. Any system intended to provide security without a key is necessarily relying on security through obscurity.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: