Forgive my ignorance, but I don't really understand if one is against security by obscurity.

I mean, passwords and encryption to me are obvious implementation of it. You can't get access because you don't know the password or encryption key (it's hidden/obscured). Once you know (how to get) it, you're in. And it's just a matter of time (i.e. processing power) to crack them. IMHO only physical protections, such as physical key/access, biometric key, (two factor) token, etc, give the real "security not by obscurity" thing (not necessarily provide the best protection).

Security gurus please shed some light on this... Thanks.

Peace always,
<jdenny>