Obscurity is "bad" security because when you're told "how it works" it's usually very weak and easily defeated.

Pairing up obscurity with "good" security should be more of a "do the benefits outweigh the costs?" type of question and only each site can answer this question.

I sincerely believe no one, crosses finger, argues that security by obscurity alone is good security. -.-