ok fair enough, sorry i may have misinterpreted what you meant.

it sounds like your argument is that if the attacker doesn’t know the service is running then the assertion that this reduces the risk profile is classified as an obscurity control - this argument is correct under these conditions.

however, certain knocking configurations are not obscurity, because their purpose & value does not depend on the hope that the attacker is unaware of the service’s existence but rather to reduce the attacker’s window of access to the service with a type of out of band whitelisting. by limiting the attacker’s access to the service you are reducing the attack surface.

you can imagine it like a stack call trace, the deeper into the trace you go, every single instruction represents the attack surface getting larger and larger. the earlier in the trace you limit access to the attacker, you are by definition reducing the attack surface.

in case i’ve misinterpreted what you meant. susceptibility to a replay attack does not mean something isn’t a security measure. it means it’s a security measure with a vulnerability. ofc replay attacks in knocking is a well known problem addressed long ago.

perhaps the other source of miscommunication is for us to remember that security is about layers, because no single layer is ever going to be perfect.

if you can’t work out what knocking might have to do with whitelisting then i’m not sure what you hoped to contribute towards reducing misconceptions in the conversation

would you classify out of band whitelisting by IP (or other session characteristic[s]) as having no security merit whatsoever?

would you classify it as purely a decision regarding network congestion & optimisation?

you’re ofc free to define these things however you wish, but in a form which is helpful to OP’s question i’m not sure i follow you.

while the most bare bones knocking implementation may be classed as obscurity, there’s certainly plenty of implementations which i wouldn’t class as obscurity.

People iterate through all the IPv4 addresses since there are only 4,294,967,296 possible addresses. There are 340,282,366,920,938,463,463,374,607,431,768,211,456 possible IPv6 addresses

i love your thinking!!

do you have a backup in case you accidentally find yourself locked out from an ipv4-only network?

you are basically correct, and i believe these concerns were raised when that apple patent hit the news.

essentially it boils down to the unpleasant fact that it’s simply currently not required.

1. recording & sharing recordings of such activities has already been outlawed in certain jurisdictions.

2. media & public narrative is already tightly controlled.

3. they already routinely get away with worse crimes against the public for the above reasons.

4. even if a handful of individuals face some vague justice, the public foots the bill with tax payer funded settlements.

one day something similar to that apple patent probably will happen though, especially as corporations merge further with our legal systems, and it’ll be labelled a breach of copyright because their uniforms have sony logos or some such