[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Australian "calculatorcard"
-- [ From: amp * EMC.Ver #2.3 ] --
From: David Lesher \ Internet: ([email protected])
To: amp \ Internet: ([email protected])
cc: Cees de Groot \ Internet: ([email protected])
cc: cypherpunks \ Internet: ([email protected])
Subject: Re: Australian "calculatorcard"
> sounds like the card i use for remote dialup to certain non-public
> systems i use at work. it has a six digit number on the front that
> changes every 60 seconds.
DS> Do these card systems use a window to handle clock-slip?
i'm not sure. i would image so.
DS> I'd think you could have the server safely accept # N, N-60 sec, and
DS> N+60 seconds; and adjust the server's idea of your card's clock speed
DS> from that.
DS> What new risk would that create?
i would figure the server would give a minute or so for slippage.
basically the risk is that it would give someone 3 minutes to do a
brute force attack rather than one. if you have decent security on
the server side, i.e., disallow the card for 5 minutes or more after 3
or so failed attempts, brute attacks would be minimized. however, if
the actual window for a single code is 3 minutes, that increases your
chance of hitting it as 3 separate numbers would be valid for a given
card at any given time.
amp
<[email protected]> (since 10/31/88)
<[email protected]>
PGP Key = 57957C9D
PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7
December 31, 1995 21:59