11 ms·

He mentions putting a color swatch on the company intranet that changes daily as a form of authentication. I wonder how well it would work to call people up an

He mentions putting a color swatch on the company intranet that changes daily as a form of authentication. I wonder how well it would work to call people up and say, "Hi, this is Paul from IT, we're having some trouble with our intranet security color swatch generator this morning. You should be seeing pink. Is that right?"

pavel_lishin 12y ago
I think that was just an example; it just needs to be some daily changing token. When a bad guy calls up your company, he should have no idea whether you use a color scheme, mythical animals, sports teams or flightless birds.
- antsar 12y ago
  Your definition of "bad guy" strangely seems to exclude disgruntled former employees.
  - pavel_lishin 12y ago
    You're right, I didn't think about that.
    - frost_knight 12y ago
      If it's a former disgruntled employee then they shouldn't know what the daily token is, since they should at that point be gone and no longer have access to such details. If they do, however, know the token, then you have another problem altogether.
      - pavel_lishin 12y ago
        But they'll know the general scheme, which would help them extract the current day's code.
        wingerlang 12y ago
        Unless the color is random each day, which would make more sense wouldn't it?
        LyndsySimon 12y ago
        "Hi, this is Paul from IT. We're having some trouble with the random color generator today, could you pop open a browser and check for me? It should be pink, but we've gotten a couple of calls saying it was a different color. What color are you seeing at your location?"
  - _mgr 12y ago
    Or disgruntled current employees.
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
sireat 12y ago
I think the daily token should be thought of as changing the default SSH port, a simple protection scheme that cuts out casual script kiddie attackers 99% yet does not deter someone who views you/your company as a specific target. The problem with the token would be if it was the sole level of protection (just like simply changing your ssh port is not enough).

pavel_lishin 12y ago

I think that was just an example; it just needs to be some daily changing token. When a bad guy calls up your company, he should have no idea whether you use a color scheme, mythical animals, sports teams or flightless birds.

antsar 12y ago
Your definition of "bad guy" strangely seems to exclude disgruntled former employees.
- pavel_lishin 12y ago
  You're right, I didn't think about that.
  - frost_knight 12y ago
    If it's a former disgruntled employee then they shouldn't know what the daily token is, since they should at that point be gone and no longer have access to such details. If they do, however, know the token, then you have another problem altogether.
    - pavel_lishin 12y ago
      But they'll know the general scheme, which would help them extract the current day's code.
      - wingerlang 12y ago
        Unless the color is random each day, which would make more sense wouldn't it?
        LyndsySimon 12y ago
        "Hi, this is Paul from IT. We're having some trouble with the random color generator today, could you pop open a browser and check for me? It should be pink, but we've gotten a couple of calls saying it was a different color. What color are you seeing at your location?"
- _mgr 12y ago
  Or disgruntled current employees.
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]

sireat 12y ago

I think the daily token should be thought of as changing the default SSH port, a simple protection scheme that cuts out casual script kiddie attackers 99% yet does not deter someone who views you/your company as a specific target. The problem with the token would be if it was the sole level of protection (just like simply changing your ssh port is not enough).