PaperlayerView exact revision on arXiv

Source-linked AI summary

The False Allure of "Security by Obscurity": A Game-Theoretic Approach

In-Uck Park, Sunoo Park

arXiv:2610.12858v1cs.GTcs.CRcs.CYecon.TH

TL;DR

The security-by-obscurity debate has relied largely on collective experience, with relatively sparse detailed sources. This paper models how good and bad hackers respond to open and closed systems, and proves that closed systems are more likely to face successful attacks before vulnerabilities are fixed.

  • Problem

    The community consensus against security by obscurity appears based more on collective experience than written records or peer review, and detailed sources are relatively sparse.

    Source: §1 · p. 2

  • Method

    The paper presents game-theoretic models in which good and bad hackers choose whether to examine open or closed systems, with closed systems more costly or difficult to examine.

    Source: §1 · p. 3

  • Results

    In equilibrium under realistic conditions, closed systems are more likely than open systems to have vulnerabilities first discovered by bad hackers rather than good hackers.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The models identify an adverse-selection effect: bad hackers are more willing to bear closed systems’ higher examination costs, while good hackers more often prefer open systems.

    Source: §1 · p. 3

    The models are stylized and do not capture all realistic factors, using minimal assumptions to demonstrate a core dynamic of strategic behavior.

    Source: §3 · p. 8

Abstract

from arXiv · show

"Security by obscurity," or the idea that hiding how a system works helps protect it from adversaries, has long been poorly regarded in the security community. Yet its intuitive appeal persists, and it has resurfaced repeatedly in industry practices and public debates over the years. The logic, on the one hand, is that open scrutiny of systems is the best way to find and respond to problems; and on the other hand, that too much openness can increase risk by giving adversaries a roadmap for attack. This isn't purely a technical question, but a human one: it's about how attackers and good-faith security researchers respond to openness in the real world. As such, security experts base their stance on decades of community experience; however, the field lacks empirical or theoretical foundations to back up these long-standing beliefs. We provide the first rigorous modeling of "security by obscurity," aiming to capture how rational actors will respond to openness or obscurity in fallible systems. We prove that in equilibrium under realistic model conditions, "obscured" systems are more likely to suffer successful attacks than "open" systems --- establishing theoretical support for the longstanding received wisdom.

1 Introduction

The paper formalizes a longstanding security-community argument against security by obscurity, addressing a gap between received wisdom and rigorous analysis. Its models show that, under realistic equilibrium conditions, closed systems are more likely than open systems to face successful attacks before vulnerabilities are fixed.

1 Introduction

  • Openness is argued to help users protect themselves and encourage repair, while withholding vulnerability information can leave defenders behind.The paper also notes concerns that attackers may gain a roadmap from openness and that secrecy may reduce owners’ incentives to mitigate flaws.Source: §1 · p. 2
  • Despite its intuitive appeal to vendors and others, secrecy’s perceived protection is weighed against openness’s security benefits.The paper notes that vendors may invoke secrecy to shield flaws, intellectual property, and business interests.Source: §1 · p. 2
  • The community’s opposition to security by obscurity rests largely on collective experience, while detailed academic treatments and rigorous analyses remain sparse.The authors say theoretical or empirical foundations could lend the argument more weight, particularly beyond the security field.Source: §1 · p. 2
  • The authors provide the first game-theoretic models and analysis of security by obscurity, focusing on whether bad hackers discover flaws before defenders.Their models consider rational actors choosing whether to examine open or obscured systems.Source: §1 · p. 3
  • At equilibrium under realistic conditions, closed systems are more likely than open systems to have vulnerabilities first discovered by bad hackers, increasing the chance of successful attacks before repair.The result follows because good hackers disclose vulnerabilities and seek repairs, whereas bad hackers exploit or sell them.Source: §1 · p. 3

2 Related Work

Prior security writing generally criticizes security by obscurity, but rigorous academic analysis of its rationales is scarce. This paper situates its approach in security economics and draws on research about ethical hackers’ motivations.

2 Related Work

  • Before modern cryptography and systems security, even critical military communications often relied on security by obscurity; the paper refers to Kahn’s history of obscurity in codemaking and codebreaking.Source: §2 · p. 4
  • Modern security literature often calls security by obscurity dangerous or ineffective, but rigorous theoretical or empirical analyses of the arguments are lacking.Empirical analysis may be difficult because realistic data and counterfactual comparisons of open versus closed systems are hard to obtain.Source: §2 · p. 4
  • Security economics studies how incentives affect security outcomes, but the authors know of no prior work in that field rigorously analyzing security by obscurity.Their model also draws on research documenting ethical hackers’ public-service motives and willingness to report findings despite potential financial gains from exploitation.Source: §2 · p. 4

3 Overview of Our Models

The paper models vulnerability hunting as strategic entry by good and bad hackers who choose systems with different examination costs and rewards. Across its models, equilibrium favors open systems in whether good or bad hackers discover vulnerabilities first, under the stated conditions.

3 Overview of Our Models

  • Players choose a system to target or abstain; the first to find a reportable or exploitable vulnerability wins, and hunting incurs costs.Good hats report vulnerabilities for repair, while bad hats exploit them or sell them; the model treats their utilities from winning as systematically different.Source: §3 · pp. 4–5
  • The models treat open systems as cheaper to examine than closed systems, with open examination assumed to cost zero and closed examination to cost more than zero.The authors note that their result holds if some fraction, however small, of good hats can examine open systems at zero cost.Source: §3 · p. 6
  • The analysis progresses from two hats and two systems to models with many hats and then multiple systems with varying intrinsic values and examination costs.The simple model omits motivation differences; the generalized models incorporate them and allow system values or costs to vary.Source: §3 · pp. 6–7
  • In every equilibrium under the model’s plausible conditions, open systems have a higher probability of being won by good hackers and a lower probability of being won by bad hackers than closed systems.The result extends to unconditional winner-type probabilities when there are sufficiently many hats, including when the fraction of bad hats is small.Source: §3 · p. 7
  • Closed systems attract hackers with higher expected rewards, who are more likely to be bad hats, while good hats are more likely to choose open systems.The simple model first establishes this ordering conditional on a system having a winner; generalized models extend it to unconditional probabilities.Source: §3 · p. 7
  • At five expected entrants, the probability a system has no winner is at most e^-5, approximately 0.0067.The paper uses this bound to argue that the required number of hats can be realistic for sensible parameters.Source: §3 · p. 7
  • The models are stylized and omit real-world factors, which the authors present as a deliberate simplification for isolating a core strategic dynamic.They state that their main models assume one winner per system and one target per player, while noting these assumptions can be extended.Source: §3 · pp. 5, 8

4 Notation and Game-Theory Preliminaries

The preliminaries define the Bayesian-game framework used to represent players’ private types, actions, outcomes, and payoffs. Equilibrium requires that no player type can improve its expected payoff by changing strategy while others’ strategies remain fixed.

4 Notation and Game-Theory Preliminaries

  • The notation section defines distribution and probability terms, including i.i.d., CDF, and the support of a function.It also defines Δ(X) as the set of probability distributions over X and [n] as {1, …, n}.Source: §4 · p. 8
  • A game specifies players, their available actions, an outcome function, and utilities; outcomes depend on the joint actions of players.In a Bayesian game, players have private types drawn from known distributions, and outcome and utility functions may depend on those types.Source: §4 · p. 8
  • Each player knows their own type and chooses an action without observing other players’ types or choices; a strategy maps a type to a distribution over actions.The paper’s players have ethical type, skill, and motivation, and may target a system or target none.Source: §4 · p. 8
  • A Bayesian Nash equilibrium is a strategy profile in which no player of any type can improve expected payoff by changing strategy alone.The expectation is over the private types of the other players.Source: §4 · p. 9

5 Simple Model

The simple model compares open and closed systems in a two-hat game where hats choose which system to examine, and proves a conditional bad-winner disadvantage for the closed system when the bad-hat reward is sufficiently large relative to examination cost.

5 Simple Model

  • Each hat in the two-hat model chooses open at zero cost, closed at cost k>0, or no system; winning yields reward VB if bad and VG if good, with VB>VG>0.Source: §5 · p. 9
  • When VB ≥ 2k, the closed system is strictly more likely than the open system to be won by a bad hat, conditional on either system having a winner.If VB < 2k, the closed system may not be worth pursuing even when all hats compete for the open system.Source: §5 · pp. 9, 11
  • Because bad hats value vulnerabilities more, they are more willing to pay the closed-system examination cost, while good hats are more likely to target open systems.Equilibrium targeting divides skill levels into regions where both types choose closed, both choose open, or bad hats choose closed while good hats choose open.Source: §5 · p. 10
  • In equilibrium, the closed system is more likely to be won by a bad hat than the open system, except when the closed-system cost is high enough to make it not worth pursuing.The exception is VB < 2k.Source: §5 · pp. 9, 11

6 Generalized Model I: Many Hats

The generalized model adds many hats with private skill and motivation, and proves that open systems are more likely to be won by good hats while closed systems can be more likely to be won by bad hats when the expected population is large and bad hats have a heavier motivation tail.

6 Generalized Model I: Many Hats

  • The model assigns each hat an ethical type, skill, and private motivation, with the number of hats modeled as Poisson with mean λ.Bad hats’ motivation distribution strictly first-order stochastically dominates good hats’, and motivation scales the reward for winning a system.Source: §6 · p. 11
  • For sufficiently large λ, an open system is more likely than a closed system to be won by a good hat, both conditional on a winner and unconditionally.The unconditional bad-hat advantage for closed systems also holds for sufficiently large λ when good hats have a thinner upper motivation tail.Source: §6 · p. 12
  • For sufficiently large λ and a thinner upper tail for good hats’ motivation distribution, a system is unconditionally more likely to be won by a bad hat when it is closed than when it is open.The tail condition requires hG(z)/hB(z) ≤ χ for some χ < 1 above a threshold.Source: §6 · p. 12
  • At a given skill level, hats target the closed system above a motivation cutoff when its expected value exceeds the open system’s; otherwise, they target open.Because bad hats’ motivation distribution dominates good hats’, bad hats are overrepresented among closed-system targets and underrepresented among open-system targets.Source: §6 · p. 13
  • As λ grows, both systems almost certainly have a winner, while the open system is more likely to have one; the results extend beyond Poisson populations when the distribution preserves the proof’s high-level steps.The conditional winner-composition difference supports the unconditional comparisons as the probability of an unwon system vanishes.Source: §6 · pp. 12–14

7 Generalized Model II: Many Systems

The model generalizes to a finite set of systems with differing intrinsic values and examination costs.

7 Generalized Model II: Many Systems

  • The generalized model allows a finite number of systems, each with an intrinsic value VT > 0 and examination cost kT ≥ 0, with no two systems sharing identical characteristics.Systems with zero examination cost are open; those with positive cost are closed.Source: §7 · p. 14
  • The model fixes an equilibrium strategy adopted by all players for the finite-system setting.The passage begins defining the probability that a player of ethical type e wins system T, but does not provide the full definition.Source: §7 · p. 14

T + WinG

Theorem 2 establishes an equilibrium result for the multi-system game and compares bad hats’ wins across closed and open systems. Under an additional condition, sufficiently large games also have winners in every system.

T + WinG

  • For every λ > 0, an equilibrium exists in the multi-system generalized game.The comparison in the preceding result applies when some closed system is targeted with positive probability.Source: T + WinG · p. 14
  • Bad hats win a larger share of total system value across closed systems than across open systems, with BadWinC > β > BadWinO.This result holds in every equilibrium in which some closed system is targeted with positive probability.Source: T + WinG · p. 14
  • If condition (6) holds, then for sufficiently large λ, every open and closed system has WinT > 0.The passage also begins a further pairwise comparison but does not state its conclusion.Source: T + WinG · p. 14

C > WinB

Theorem 2 extends the comparison of bad hats’ wins across open and closed systems. The discussion also describes how the model’s conclusions extend under multiple vulnerabilities, repeated games, and broader targeting.

C > WinB

  • Across closed systems, bad hats win a strictly larger fraction of total system value than across open systems; pairwise extensions require condition (6).Parts (b) and (c) extend earlier results to every open–closed system pair, with condition (6) additionally needed for part (b).Source: C > WinB · p. 14

7.1 Further generalizations

  • With multiple vulnerabilities or repeated games, the model can be extended; the authors expect repeated games not to change the qualitative results.Multiple winners are modeled by multiplying the contest-success probability by η > 1; repeated games update system values after each win.Source: §7.1 · p. 15
  • When hats may target multiple systems, every open system has a winner for sure, while each closed system is won by a bad hat with probability higher than β as λ → ∞.The closed-system outcome follows from the threshold rule for targeting closed systems described in the passage.Source: §7.1 · p. 15
  • The Poisson assumption mainly simplifies calculations and helps establish equilibrium existence; the key assumptions are higher costs for closed systems and systematically higher rewards for bad hats.The authors note that differences between good and bad hats in other respects may strengthen or weaken the results.Source: §7.1 · p. 15

8 Discussion and Open Directions

The discussion connects vulnerability discovery tools to unpatched issues and exploitation risk, while noting that discovery incentives and the effects of other obscurity rationales remain open research questions.

8 Discussion and Open Directions

  • Human triage, verification, and fixes are struggling to keep pace with AI-assisted vulnerability discovery, contributing to a backlog of unpatched issues and associated exploitation risk.The passage identifies human developers as responsible for triaging results, verifying complex edge cases, and deploying stable fixes.Source: §8 · p. 16
  • The model leaves post-discovery outcomes out of scope, including how AI tools might change good hats’ reporting incentives or bad hats’ exploitation utility.The authors say explicitly modeling these incentive changes and likely security outcomes would be interesting future work.Source: §8 · p. 16
  • The analysis addresses one rationale against obscurity—open scrutiny helps find and fix problems—while game-theoretic analysis of other rationales remains future work.The passage does not claim to analyze every argument for or against obscurity.Source: §8 · p. 16

9 Conclusion

The paper concludes that its game-theoretic analysis provides theoretical substantiation for the security community’s view that hiding systems is generally worse than inviting scrutiny. Its appendices derive equilibrium targeting behavior and show how an alternative ethical-types model reduces to the paper’s main model.

9 Conclusion

  • The game-theoretic analysis provides theoretical support for the view that hiding how a system works is generally worse for security than widespread scrutiny.The authors describe this as the first rigorous modeling and theoretical substantiation of the security community’s longstanding experience.Source: §9 · p. 16

A Deriving PT

  • In equilibrium, a hat targets open systems when zi < z∗(si) and closed systems when zi > z∗(si).Strategies are deterministic except when zi = z∗(si).Source: A Deriving PT · p. 19

B Alternative Model of Ethical Types

  • In the alternative model, a hat reports when rG > rB and exploits when rG < rB; the resulting types and rewards reduce to the model used in Sections 6 and 7.A bad hat occurs with probability β, and a good hat with probability 1 − β.Source: B Alternative Model of Ethical Types · p. 20

C Proof of Theorem 1 and Theorem 2

This section proves equilibrium existence and compares bad actors’ success in closed and open systems, including extensions to multiple systems and some bounded-support settings. It also reports conservative approximate upper bounds for λ* and describes the parameter settings, bounding argument, and verification procedure used to obtain them.

C Proof of Theorem 1 and Theorem 2

C > WinB

  • BadWinC > β > BadWinO: bad actors win closed systems more often than their population share and open systems less often.The proof also establishes this result for the one-open, one-closed-system case of Theorem 1.Source: C Proof of Theorem 1 and Theorem 2 · p. 21, C > WinB · p. 23
  • For almost every skill–motivation pair, there is a unique optimal target, with a motivation cutoff separating open-system from closed-system targeting.The proof establishes uniqueness by showing payoff ties occur only on a measure-zero set; the cutoff is infinite when no closed system has a higher payoff slope than the best open system.Source: C > WinB · pp. 22–23

O > WinG

  • For sufficiently large λ, closed-system winners have a bad-actor share at least ξ > β, open-system winners have a share at most β, and every system has a positive win probability bounded away from zero.The proof shows every system is eventually targeted with positive probability; the lower bound on win probabilities exceeds the stated thresholds.Source: O > WinG · p. 24

D Additional Remarks on Generalizability

  • With bounded motivation support, the theorem extends under conditions (5) and (6), while positive open-system entry costs may invalidate the limiting result.In the bounded-support case, open-system loads diverge while closed-system loads remain bounded, preserving a closed-system conditional bad-actor share above β. For reasonable λ, the results may still hold with slightly higher open-system entry costs.Source: D Additional Remarks on Generalizability · pp. 26–27

E Approximating the Number of Hats Needed

E.1 Parameter setting

  • The parameter setting uses one open and one closed system with equal values of 1, β = 0.2, zero open-system cost, and closed-system costs k ∈ {0.5, 1, 2}.It considers weight ratios γ ∈ {1.2, 2, 5} and motivation distributions with exponential bad-actor motivations and good-actor distributions first-order stochastically dominated by them, parametrized by τ.Source: §E.1 · pp. 27–28
  • For τ∈[0,1), the parameter pairs satisfy (5) and (6), and lower τ is expected to lower the λ* bound as the good- and bad-hat distributions differ more.Source: §E.1 · p. 28

E.2 Approximation results

  • Table 1 reports approximate conservative upper bounds for λ* across the specified k, γ, and τ settings; the bounds may substantially exceed actual values.The approximations use relatively loose conditions intended to work across skill distributions and weight functions for a given γ.Source: §E.2 · pp. 28–29, Table 1 · p. 29

E.3 Bounding λ*

  • The bound uses monotone response fixed points x(λ) and y(λ) and cutoff lower bounds; positivity of ΔB and ΔG at λ* suffices for all λ≥λ*.Source: §E.3 · p. 30

E.4 Methodology and Verification

  • ChatGPT approximated the Table 1 values, which were checked with a Python verifier implementing Algorithm 1 whose code was manually verified against the pseudocode.The verification code is provided in full at the cited Codeberg location.Source: §E.4 · p. 31
Loading 2610.12858v1…