Barclays PINsentry

aardvaak

Can someone please explain to me how Barclays PINsentry works?

I know how to operate it what I don't know is how does the Barclays log in site know the random number generated by the the machine is correct - the machine is not connected to the computer.

Donnie

It's possible that the calculator is pre-programmed with a specific formula. So it's not a random number.

Nilrem

IIRC the basic way it works is that at the time the pin sentry devices are made they have an internal clock set, and synced to the servers to sort out the timing issues.

Once set it uses the cryptographic key set in the factory (that the servers know the decryption key for), and a combination of the time and the card used in it to create a short lived code (60 seconds from memory) that is accepted by the servers.

It's also how/why you are able to use someone else's pin sentry with your card, or even in some cases another bank's device (the banks share the technology to make it easier for customers).
It's also why I believe when the batteries in the device dies you have to get a replacement unit, and not just swap the battery yourself.

Basically it's about as secure as you can realistically get at the moment, without spending a lot of money - as long as your computer isn't infected with something that lets someone else see/use the data within the 60 seconds


On a vaguely related note, the current "securecode" and "verified by visa" systems were originally tried with a similar system (I was in the Barclaycard mastercard trial), but dropped for some reason, something that annoyed me a lot, as the password system they use instead is a lot less secure and harder for me to use (I use decent, long/complicated passwords, and it's much harder to remember an 8+ digit random password than use a standalone card reader).