Card Readers/Secure Keys

MoneySavingUser

Can someone explain in very simple terms how these work?

How does the website know that you have entered the number that has been generated on the device?

glider3560

For card readers...
The chip on the card contains an algorithm programmed into it by the bank that generates a code everytime you enter the correct PIN. As the website and card know the same algorithm, it knows what number to expect.

For tokens (e.g. HSBC)...
Same principle but the algorithm is on the token instead of the card.

This is a VERY basic explanation of how it works, but I hope you get the gist!

izools

The other thing to note about the HSBC token is that the codes are time sensitive - i.e. the token contains a clock so a code generated one minute won't work later in the day if you make a note of it and try it later. The server at the bank predicts what code will be generated based on the time, the source cipher key, and the encryption algorhithm, and checks that what is entered by the user on the website is the same.

RSA Secure ID tokens work like this, too, the code on them changes every 60 seconds.

MoneySavingUser

Ok thanks - yes I assumed it would be some algorithm - and the time element makes sense to as otherwise you could create a whole list of codes in advance etc.

Olipro

MoneySavingUser wrote: »

Ok thanks - yes I assumed it would be some algorithm - and the time element makes sense to as otherwise you could create a whole list of codes in advance etc.

the application on the card increments the ATC but otherwise does not implement any time sensitivity, you can therefore freely generate codes in advance providing you know what reference number you'll be requested to use.

codes may fall out of validity once you use the card for any sort of Card-Present chip transaction such as a purchase or ATM withdrawal.