the meaningful difference is whether de-obscuring the thing breaks one account, or all accounts. if one, that's a credential leak. if all, that's security by obscurity