I was thinking the same thing on security-through-obscurity.

a hacker might know how to hack your service, but they'd have to find it first.