Obscurity can offer some security, but its usefulness is very limited. Among other things:

1. It is difficulty to quantify how much security it offers, since human beings make very bad random number generators, so it's hard for someone who comes up with a seemingly-original idea to know how likely it is that someone else would think of it.

2. Although it is not difficult to come up with an algorithm which will be secure under the right conditions, maintaining those conditions is difficult: the algorithm and all plaintexts must be forever kept secret from anyone who wouldn't be trusted with the content of all messages that were ever sent using it. Further, the total volume of ciphertext available must be kept fairly small, but it's difficult to quantify how small.

3. The only way to compartmentalize risk is to use independently-devised algorithms for every different kind of message whose disclosure shouldn't affect any others. Devising truly independent algorithms is difficult for reason #1 above, and most approaches that rely upon security through obscurity fail to properly compartmentalize risk as a result.

Although things like DES, AES, etc. are often described as "algorithms", it would perhaps be more useful to think of them as "algorithm generators". If one has a good source of 256-bit random numbers that have essentially zero probability of matching anything else anywhere in the universe, then "use AES with this number I just generated" can be used as an encryption algorithm which can for all practical purposes be treated as completely unlike anything that anyone else has ever devised. Consequently, it's much easier to compartmentalize risk using such approaches than by devising one's own encryption schemes.

Obscurity can offer some security, but its usefulness is very limited. Among other things:

1. It is difficulty to quantify how much security it offers. Since human beings make very bad random number generators, it's hard for someone who comes up with a seemingly-original idea to know how likely it is that someone else would think of it.

2. Although it is not difficult to come up with an algorithm which will be secure under the right conditions, maintaining those conditions is difficult. The algorithm and all plaintexts must be forever kept secret from anyone who wouldn't be trusted with the content of all messages that have ever been sent using it. Further, the total volume of ciphertext available must be kept fairly small, but it's difficult to quantify how small.

3. The only way to compartmentalize risk is to use cryptographically-independent algorithms for every different kind of message whose disclosure shouldn't affect any others. Devising truly independent algorithms is difficult for reason #1 above, and most approaches that rely upon security through obscurity fail to properly compartmentalize risk as a result.

Although things like DES, AES, etc. are often described as "algorithms", it would perhaps be more useful to think of them as "algorithm generators". If one has a good source of 256-bit random numbers that have essentially zero probability of matching anything else anywhere in the universe, then "use AES with this number I just generated" can be used as an encryption algorithm which is cryptographically independent from any other algorithm that has ever existed. Consequently, it's much easier to compartmentalize risk using such approaches than by devising one's own encryption schemes.