It seems to me that a simpler solution than challenge-response would be to emultate the tear-sheet crypto systems and just have a series of one-shot passwords generated. Each time you log in, it requires the next password from the sheet, so capturing the old one does no good (just as breaking the one-time codes from tear sheets doesn't help). Now if I could just figure out a simple way to do this on UNIX... --Alan