Hacker News Reader

Comment by Scramblejams | Hacker News Reader

He mentions putting a color swatch on the company intranet that changes daily as a form of authentication.

I wonder how well it would work to call people up and say, "Hi, this is Paul from IT, we're having some trouble with our intranet security color swatch generator this morning. You should be seeing pink. Is that right?"

View on HN

I think that was just an example; it just needs to be some daily changing token. When a bad guy calls up your company, he should have no idea whether you use a color scheme, mythical animals, sports teams or flightless birds.

Your definition of "bad guy" strangely seems to exclude disgruntled former employees.

You're right, I didn't think about that.

If it's a former disgruntled employee then they shouldn't know what the daily token is, since they should at that point be gone and no longer have access to such details.

If they do, however, know the token, then you have another problem altogether.

But they'll know the general scheme, which would help them extract the current day's code.

Unless the color is random each day, which would make more sense wouldn't it?

"Hi, this is Paul from IT. We're having some trouble with the random color generator today, could you pop open a browser and check for me? It should be pink, but we've gotten a couple of calls saying it was a different color. What color are you seeing at your location?"

Or disgruntled current employees.

I think the daily token should be thought of as changing the default SSH port, a simple protection scheme that cuts out casual script kiddie attackers 99% yet does not deter someone who views you/your company as a specific target.

The problem with the token would be if it was the sole level of protection (just like simply changing your ssh port is not enough).

Reply on news.ycombinator.com