I'm sure there is real science to this.
When I'm playing Guitar Hero (love it!), I can tell a few seconds before I miss a note that I'm going to miss a note. Sometimes (rarely), I can "calm myself down/refocus" and avoid the miss. I've seen this same phenom in others and talking to them, they are aware prior to making a mistake that 'one is coming soon':-)
Normal solution. You have a device that when given a challenge code it responds with a response code that proves to the challenger that you have the key without actually responding with the key. Challenge codes are non-reusable so knowing one pair gets a cracker nothing.
Security researchers have beat this to death, and this is good.
Even better though, One of the banks I worked with, gave out devices that would generate a new code every 60 seconds or so. Users are asked to input the code on the device as part of thier password-set. If you don't have this device, you cannot guess the magic code, you cannot get into the system, I don't care what you logged.
Ofcourse, both of the above require a host that is complient with, and concerned about, securing your credentials.:)
Take the link down please. It claims that slashdot slammed it.
----------- SERVER TOO BUSY
Because of the [snip]exposure on slashdot today, we experienced an unexpected number of users. The service can be temporarily down from time to time. We will be back online when the load is lower. For more information about the project, go to the project Website, read an earlier publication on this project, or contact Prof. James Wang by email at jwang at ist.psu.edu .
-- Thanks, the IMAGINATION team. April 23, 2008 -------------
Slashdot Mirror
I'm sure there is real science to this. When I'm playing Guitar Hero (love it!), I can tell a few seconds before I miss a note that I'm going to miss a note. Sometimes (rarely), I can "calm myself down/refocus" and avoid the miss. I've seen this same phenom in others and talking to them, they are aware prior to making a mistake that 'one is coming soon' :-)
This is a classic public key/private key problem.
:)
Normal solution.
You have a device that when given a challenge code it responds with a response code that proves to the challenger that you have the key without actually responding with the key. Challenge codes are non-reusable so knowing one pair gets a cracker nothing.
Security researchers have beat this to death, and this is good.
Even better though,
One of the banks I worked with, gave out devices that would generate a new code every 60 seconds or so.
Users are asked to input the code on the device as part of thier password-set.
If you don't have this device, you cannot guess the magic code, you cannot get into the system, I don't care what you logged.
Ofcourse, both of the above require a host that is complient with, and concerned about, securing your credentials.
Take the link down please. It claims that slashdot slammed it.
-----------
SERVER TOO BUSY
Because of the [snip]exposure on slashdot today, we experienced an unexpected number of users. The service can be temporarily down from time to time. We will be back online when the load is lower. For more information about the project, go to the project Website, read an earlier publication on this project, or contact Prof. James Wang by email at jwang at ist.psu.edu .
-- Thanks, the IMAGINATION team.
April 23, 2008
-------------