Comment by geofft

The "security by obscurity" bit is interesting. I'm now imagining a server where it checks that the initial sequence number of the SYN packet ends with your current OATH two-factor authentication code, or something, and it drops the packet if you have the wrong code. (Which elevates it quite a bit past simply "obscurity.") The traffic is indistinguishable from normal SSH traffic, and there's very little code that has to process anything from untrusted sources.