Thanks to everyone who replies... especially Tim_axe with his confusing example (his idea about randomness did remind me about the cryptography concept).

I understand that we can't rely on security by obscurity (alone). However, it adds another layer of protection, doesn't it? I just want to understand why people try to avoid it. I mean it's not that bad, but yes, we also need to put some other kind of security measure in place.

Regarding changing the default settings, what about changing the default admin password on routers/servers/anything? Is it security by obscurity too? So if it's bad, then we don't need to change default passwords?

To me, something is obscure if nobody or only a few people know about it. With the right skill and tools, nothing is impossible. You never know, what bored teenagers and their friends and their brothers can do with all their and their relatives PCs. If encryption can be defeated, isn't it as bad as changing default http port?

Please don't get me wrong. I'm not encouraging security by obscurity (alone). But I don't think we must not use it.

Peace always,
<jdenny>