Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Code Project
  1. Home
  2. The Lounge
  3. Bank security tokens

Bank security tokens

Scheduled Pinned Locked Moved The Lounge
hardwaresecurityquestion
12 Posts 7 Posters 0 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • N Offline
    N Offline
    normanS
    wrote on last edited by
    #1

    My mother recently opened a Capitec Bank account (www.capitec.co.za[^]) and they issued her with a security token which displays a 6-digit one-time password every time she presses a button. She says the number is only displayed for about 10 seconds, so I got her to do an experiment - press button, note the number, as soon as the display blanks press button again and note the number, as soon as the display blanks press button again and note the number. All 3 OTPs were different, so I assume this is an event-based system. So far so good. The funny thing is that the instructions tell you to hold the device in your left hand and "quite close to the PC" when you press the button. My mother reports that her friend Kathy (an ex-Applied Maths lecturer like my mother, not given to superstition) had her Capitec Bank token some distance from her PC and pressed the button, and the display gave some alpha-numeric code rather than the numeric OTP. Bringing the token into the specified position relative to the PC and pressing the button gave a normal numeric OTP. My mother repeated the experiment while I was on the phone with her, and got a similar alphanumeric code. So what's going on? My mother has one of my old PCs, with no WiFi, no Bluetooth, no nothing! She collected the token from a bank branch, there's no special hardware installed on the PC. Are both these little old ladies having fantasies?

    OriginalGriffO H R V 4 Replies Last reply
    0
    • N normanS

      My mother recently opened a Capitec Bank account (www.capitec.co.za[^]) and they issued her with a security token which displays a 6-digit one-time password every time she presses a button. She says the number is only displayed for about 10 seconds, so I got her to do an experiment - press button, note the number, as soon as the display blanks press button again and note the number, as soon as the display blanks press button again and note the number. All 3 OTPs were different, so I assume this is an event-based system. So far so good. The funny thing is that the instructions tell you to hold the device in your left hand and "quite close to the PC" when you press the button. My mother reports that her friend Kathy (an ex-Applied Maths lecturer like my mother, not given to superstition) had her Capitec Bank token some distance from her PC and pressed the button, and the display gave some alpha-numeric code rather than the numeric OTP. Bringing the token into the specified position relative to the PC and pressing the button gave a normal numeric OTP. My mother repeated the experiment while I was on the phone with her, and got a similar alphanumeric code. So what's going on? My mother has one of my old PCs, with no WiFi, no Bluetooth, no nothing! She collected the token from a bank branch, there's no special hardware installed on the PC. Are both these little old ladies having fantasies?

      OriginalGriffO Offline
      OriginalGriffO Offline
      OriginalGriff
      wrote on last edited by
      #2

      But does her router have WiFi?

      Real men don't use instructions. They are only the manufacturers opinion on how to put the thing together. Manfred R. Bihy: "Looks as if OP is learning resistant."

      "I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
      "Common sense is so rare these days, it should be classified as a super power" - Random T-shirt

      L N 2 Replies Last reply
      0
      • OriginalGriffO OriginalGriff

        But does her router have WiFi?

        Real men don't use instructions. They are only the manufacturers opinion on how to put the thing together. Manfred R. Bihy: "Looks as if OP is learning resistant."

        L Offline
        L Offline
        Luc Pattyn
        wrote on last edited by
        #3

        Very Short Distance Wifi? :confused:

        Luc Pattyn [Forum Guidelines] [My Articles] Nil Volentibus Arduum

        Please use <PRE> tags for code snippets, they preserve indentation, improve readability, and make me actually look at the code.

        OriginalGriffO 1 Reply Last reply
        0
        • L Luc Pattyn

          Very Short Distance Wifi? :confused:

          Luc Pattyn [Forum Guidelines] [My Articles] Nil Volentibus Arduum

          Please use <PRE> tags for code snippets, they preserve indentation, improve readability, and make me actually look at the code.

          OriginalGriffO Offline
          OriginalGriffO Offline
          OriginalGriff
          wrote on last edited by
          #4

          It's a better bet than Psychic Powers! Not a lot better, I'll admit, but a bit... :laugh:

          Real men don't use instructions. They are only the manufacturers opinion on how to put the thing together. Manfred R. Bihy: "Looks as if OP is learning resistant."

          "I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
          "Common sense is so rare these days, it should be classified as a super power" - Random T-shirt

          1 Reply Last reply
          0
          • N normanS

            My mother recently opened a Capitec Bank account (www.capitec.co.za[^]) and they issued her with a security token which displays a 6-digit one-time password every time she presses a button. She says the number is only displayed for about 10 seconds, so I got her to do an experiment - press button, note the number, as soon as the display blanks press button again and note the number, as soon as the display blanks press button again and note the number. All 3 OTPs were different, so I assume this is an event-based system. So far so good. The funny thing is that the instructions tell you to hold the device in your left hand and "quite close to the PC" when you press the button. My mother reports that her friend Kathy (an ex-Applied Maths lecturer like my mother, not given to superstition) had her Capitec Bank token some distance from her PC and pressed the button, and the display gave some alpha-numeric code rather than the numeric OTP. Bringing the token into the specified position relative to the PC and pressing the button gave a normal numeric OTP. My mother repeated the experiment while I was on the phone with her, and got a similar alphanumeric code. So what's going on? My mother has one of my old PCs, with no WiFi, no Bluetooth, no nothing! She collected the token from a bank branch, there's no special hardware installed on the PC. Are both these little old ladies having fantasies?

            H Offline
            H Offline
            Henry Minute
            wrote on last edited by
            #5

            Perhaps it is a security feature, so that if you are far enough from the PC (ping response time/signal strength) that someone else could also read it, it gives a 'phoney' passcode.

            Henry Minute Do not read medical books! You could die of a misprint. - Mark Twain Girl: (staring) "Why do you need an icy cucumber?" “I want to report a fraud. The government is lying to us all.” I wouldn't let CG touch my Abacus! When you're wrestling a gorilla, you don't stop when you're tired, you stop when the gorilla is.

            N 1 Reply Last reply
            0
            • N normanS

              My mother recently opened a Capitec Bank account (www.capitec.co.za[^]) and they issued her with a security token which displays a 6-digit one-time password every time she presses a button. She says the number is only displayed for about 10 seconds, so I got her to do an experiment - press button, note the number, as soon as the display blanks press button again and note the number, as soon as the display blanks press button again and note the number. All 3 OTPs were different, so I assume this is an event-based system. So far so good. The funny thing is that the instructions tell you to hold the device in your left hand and "quite close to the PC" when you press the button. My mother reports that her friend Kathy (an ex-Applied Maths lecturer like my mother, not given to superstition) had her Capitec Bank token some distance from her PC and pressed the button, and the display gave some alpha-numeric code rather than the numeric OTP. Bringing the token into the specified position relative to the PC and pressing the button gave a normal numeric OTP. My mother repeated the experiment while I was on the phone with her, and got a similar alphanumeric code. So what's going on? My mother has one of my old PCs, with no WiFi, no Bluetooth, no nothing! She collected the token from a bank branch, there's no special hardware installed on the PC. Are both these little old ladies having fantasies?

              R Offline
              R Offline
              Roger Wright
              wrote on last edited by
              #6

              Maybe it relies on radiation emitted by the PC for a seed value, and beyond a certain distance can only sense background RF noise. You could test it if you have a TEMPEST[^]-hardened computer available. :)

              Will Rogers never met me.

              N W 2 Replies Last reply
              0
              • R Roger Wright

                Maybe it relies on radiation emitted by the PC for a seed value, and beyond a certain distance can only sense background RF noise. You could test it if you have a TEMPEST[^]-hardened computer available. :)

                Will Rogers never met me.

                N Offline
                N Offline
                normanS
                wrote on last edited by
                #7

                Nice try, but South Africa are not NATO, so TEMPEST equipment is not available to my mother. I'll have to find some other test.

                1 Reply Last reply
                0
                • OriginalGriffO OriginalGriff

                  But does her router have WiFi?

                  Real men don't use instructions. They are only the manufacturers opinion on how to put the thing together. Manfred R. Bihy: "Looks as if OP is learning resistant."

                  N Offline
                  N Offline
                  normanS
                  wrote on last edited by
                  #8

                  I didn't do the ADSL installation and setup, but I'm fairly sure her ADSL modem only has a USB interface, or maybe a single Ethernet port. It was whatever the ADSL ISP provided for free so no frills!

                  1 Reply Last reply
                  0
                  • H Henry Minute

                    Perhaps it is a security feature, so that if you are far enough from the PC (ping response time/signal strength) that someone else could also read it, it gives a 'phoney' passcode.

                    Henry Minute Do not read medical books! You could die of a misprint. - Mark Twain Girl: (staring) "Why do you need an icy cucumber?" “I want to report a fraud. The government is lying to us all.” I wouldn't let CG touch my Abacus! When you're wrestling a gorilla, you don't stop when you're tired, you stop when the gorilla is.

                    N Offline
                    N Offline
                    normanS
                    wrote on last edited by
                    #9

                    But that requires bidirectional comms between the token and the PC, which I don't think exists.

                    1 Reply Last reply
                    0
                    • N normanS

                      My mother recently opened a Capitec Bank account (www.capitec.co.za[^]) and they issued her with a security token which displays a 6-digit one-time password every time she presses a button. She says the number is only displayed for about 10 seconds, so I got her to do an experiment - press button, note the number, as soon as the display blanks press button again and note the number, as soon as the display blanks press button again and note the number. All 3 OTPs were different, so I assume this is an event-based system. So far so good. The funny thing is that the instructions tell you to hold the device in your left hand and "quite close to the PC" when you press the button. My mother reports that her friend Kathy (an ex-Applied Maths lecturer like my mother, not given to superstition) had her Capitec Bank token some distance from her PC and pressed the button, and the display gave some alpha-numeric code rather than the numeric OTP. Bringing the token into the specified position relative to the PC and pressing the button gave a normal numeric OTP. My mother repeated the experiment while I was on the phone with her, and got a similar alphanumeric code. So what's going on? My mother has one of my old PCs, with no WiFi, no Bluetooth, no nothing! She collected the token from a bank branch, there's no special hardware installed on the PC. Are both these little old ladies having fantasies?

                      V Offline
                      V Offline
                      Vikram A Punathambekar
                      wrote on last edited by
                      #10

                      That is really weird. The numbers are continuously generated and pressing the button just enables the display, but I have no idea how it would have to be next to a PC for it to work. These are SSDs though, right? No offence to these ladies' capabilities, but maybe they just confused 1 for I or 8 for B? :)

                      Cheers, विक्रम (CCC count - 6.) "We have already been through this, I am not going to repeat myself." - fat_boy, in a global warming thread :doh:

                      N 1 Reply Last reply
                      0
                      • R Roger Wright

                        Maybe it relies on radiation emitted by the PC for a seed value, and beyond a certain distance can only sense background RF noise. You could test it if you have a TEMPEST[^]-hardened computer available. :)

                        Will Rogers never met me.

                        W Offline
                        W Offline
                        wizardzz
                        wrote on last edited by
                        #11

                        :thumbsup:

                        Craigslist Troll: litaly@comcast.net "I have a theory that the truth is never told during the nine-to-five hours. " — Hunter S. Thompson

                        1 Reply Last reply
                        0
                        • V Vikram A Punathambekar

                          That is really weird. The numbers are continuously generated and pressing the button just enables the display, but I have no idea how it would have to be next to a PC for it to work. These are SSDs though, right? No offence to these ladies' capabilities, but maybe they just confused 1 for I or 8 for B? :)

                          Cheers, विक्रम (CCC count - 6.) "We have already been through this, I am not going to repeat myself." - fat_boy, in a global warming thread :doh:

                          N Offline
                          N Offline
                          normanS
                          wrote on last edited by
                          #12

                          ?? SSD - Wikipedia suggests http://en.wikipedia.org/wiki/SSD_(disambiguation)[^] Or is SSD = Silly Senior Dames? I wondered about suggesting to my mother that she should hold the device the right way up, but since she taught me how to do "hello" on her HP-45 http://en.wikipedia.org/wiki/Hp-45[^] in mid 1970s, that would have been disrespectful. I was wondering whether it picks up RF from the computer, to avoid skipping too many codes when the button gets pressed in your pocket. But why go to that complication / added expense when other token manufacturers don't find it necessary? I guess I'll have to experiment with her token next time I'm in Cape Town.

                          1 Reply Last reply
                          0
                          Reply
                          • Reply as topic
                          Log in to reply
                          • Oldest to Newest
                          • Newest to Oldest
                          • Most Votes


                          • Login

                          • Don't have an account? Register

                          • Login or register to search.
                          • First post
                            Last post
                          0
                          • Categories
                          • Recent
                          • Tags
                          • Popular
                          • World
                          • Users
                          • Groups