I think engineers (and computer scientists, perhaps even more so) have an unduly binary view of security.
If you are specifically targeted, you're probably screwed no matter how good your security is. If the attack isn't getting through remotely, it may escalate into social engineering, or even into physical attack, up to and including physical keyboard bugs and monitor signal sniffing.
If you're not specifically targeted, and are merely part of the crowd, you don't have so much to worry about, because you can play the numbers game. All you need to be is more secure (a couple of standard deviations) than the average. In these circumstances, security through obscurity is statistically measurable: yes, in the binary sense it's wrong to think of obscurity giving you security, but in the practical sense, it measurably decreases your risk of being compromised.
If you are specifically targeted, you're probably screwed no matter how good your security is. If the attack isn't getting through remotely, it may escalate into social engineering, or even into physical attack, up to and including physical keyboard bugs and monitor signal sniffing.
If you're not specifically targeted, and are merely part of the crowd, you don't have so much to worry about, because you can play the numbers game. All you need to be is more secure (a couple of standard deviations) than the average. In these circumstances, security through obscurity is statistically measurable: yes, in the binary sense it's wrong to think of obscurity giving you security, but in the practical sense, it measurably decreases your risk of being compromised.