Is the practice of "security through obscurity" violating Kerckhoffs's second principle? Security through obscurity is the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system.

Kerckhoffs's second principle:


  
  "It should not require secrecy, and it should not be a problem if it falls into enemy hands"
  


As stated here in the section "Security through obscurity":


  "It helps, I think, to go back to Kerckhoffs's second principle, translated as "The system must not require secrecy and can be stolen by the enemy without causing trouble," [...]. Kerckhoffs said neither "publish everything" nor "keep everything secret"; rather, he said that the system should still be secure even if the enemy has a copy."


But isn't the practice of security through obscurity still violating Kerckhoffs's second principle per definition?

And why are people even practicing security through obscurity if it, as stated, doesn't provide more security?
"It should not require secrecy, and it should not be a problem if it  falls into enemy hands"


Where "it" is the algorithm design itself, and not an input to it...


  But isn't the practice of security through obscurity still violating Kerckhoffs's second principle per definition?


Yes. Obscurity is hardly a defense that demands prohibitive computational cost from an attacker to work around. It makes the problem inconvenient, rather than computationally intractable. 

However, it should be noted that "Security through obscurity" and "Security plus obscurity" are not the same thing. 

Using algorithms that would be secure even if the adversary knew all about them, but additionally declining to let the adversary know about them is not worse than using a secure algorithm by itself. It is debatable if it is any better, as there is no such thing as "more secure" if it is already "secure".


  And why are people even practicing security through obscurity if it, as stated, doesn't provide more security?


Even the naive realize that secrecy is critical for cryptography to function. But:


They almost certainly don't have the knowledge that has been painstakingly gathered by years of failure and research (history of cryptography and modern research).


e.g. that security through obscurity is not sufficient

They may have never heard of Kerckhoff's principle
They probably have not heard of/do not understand linear/differential cryptanalysis/number theory/group theory and other modern analysis techniques. 
They clearly don't understand that concentrating secrecy into a key is far more effective than keeping an entire algorithm a secret.


For a meatspace analogy: Your front door is not secure because attackers don't know that it is locked or what it is locked with, but because they don't have the key*.

They probably don't have the kind of confidence in their setup that comes about as a result of thorough research and analysis.


If you examine the work of a successful cryptographer, for example Daniel J Bernstein, then you will find no obscurity anywhere. All of the details of the designs and implementations are publicly available. 



*Disregarding real-world details such as lock picks and lock models that are keyed alike.