@NormanDunbar @TheBreadmonkey It is the design anti-pattern of security through obscurity. It parallels the “4” incident (* Do not roll your own cryptography unless you have national resources backing you) in that amateurs, convinced of their own cleverness, pushed a security item without vetting by security experts. Fun fact, if your company processes credit cards, the payment processing people contractually impose organizational controls on security.