Just protect your keys in HSMs and all of this TCP mumbo-jumbo trying to pretend to be a secondary weak password becomes entirely unnecessary.
replyEveryone is free to choose what options work best for their needs and budgets. I would never attempt to inhibit anyone's choices. I use what has worked well for me and stifled red-team members.
replyYes and you can change the protocol field in your TCP stack to run all connections over ip protocol 200 too, but it doesn’t add any security to your authentication system over and above your private key. What you are doing is the same thing; lots of extra too-clever-by-half complexity that doesn’t actually benefit you.
reply"Security by obscurity isn't."
reply"Security by obscurity isn't."
replyCorrect. Thankfully none of what I am doing is security through obscurity. It's actual security with a subtle scent of obscurity. If it was just obfuscation and you knew something, then you could do that something from somewhere else which you can not.