How does a security token work? - Internet Poker

Nielsio · 05-07-2009, 11:42 PM

Quote:

How does my RSA security token (Secure ID) work?
How does it sync with my PC?

Quote:

Firstly, I have to make it clear there is no connection in any way to the token. It is a purely standalone device. The other answer I have seen is nonsense! Sorry!

The 6 digit code that you see on the token is generated using an algorithm that is exists in all tokens. The token also contains a clock and has a unique seed number. The current time and the unique seed are processed using the algorithm and produce the token code you see on the token. This is normally
done 1 per minute. In this way a unique code is generated that appears to be random.

The server (Ace server), that is online and connected to whatever system you are logging on to, also knows the time and it also knows the unique seed number of your token. So it uses the same algorithm to calculate the code that you should see on your token. If they match then you are authenticated.

I guess the next question you are asking is what happens if the time is wrong on the token (or the server). Well this can happen and for that reason the server normally allows a 3 minute window. So it will calculate and accept passcodes based on the current time and a minute either way. If the code is more than 2 minutes out and less than 10 then the server will recognize this code also but will ask for the next code as well to confirm you really have the token and didn't just read it by chance on someone elses token. If the time is slightly wrong then the server sets a time offset for the token and remembers that it is x minutes out. It then knows to expect this and has effectively synchronized the token.

There's loads more to it so if you think of any questions I'll be happy to answer them. Hope this helps!
Source(s):
RSA Security

http://answers.yahoo.com/question/in...0225640AAMHJZB

For poker offering websites who don't have this feature: please allow users this option (free or for pay) to improve the industry's image and create consumer trust for day-to-day operations, which welcomes new people to the game and keeps away people with bad intentions or those that want to ban or restrict the game.

**Suigin406** · 05-07-2009, 11:50 PM

Nice thread, hopefully as more people realize what RSA exactly is and the benefits are, the more pressure will come down on more poker sites to implement this.

RollinHand · 05-08-2009, 12:22 AM

If you are using AIM, this thread is def for you, amirite!?

99killed · 05-08-2009, 12:54 AM

love mine ty stars

Pokerho · 05-08-2009, 01:23 AM

cmon FT, we're waiting.

apefish · 05-08-2009, 01:55 AM

I'm pretty sure you put your token in your hand and a buddy does the same and then reveal at the same time and lower number buys the drinks.

cardman · 05-08-2009, 06:40 AM

Quote:

Originally Posted by Pokerho

cmon FT, we're waiting.

Has FT stated their intentions on secure tokens? Or is it still radio silence?

BorisHsArivd · 05-08-2009, 07:14 AM

I was wondering how hard it would be to figure out the algorithm if you knew a bunch of the codes. Anyone know? Thanks

All Hail Circe · 05-08-2009, 08:34 AM

Quote:

Originally Posted by Pokerho

cmon FT, we're waiting.

and waiting...but of course " They're working on 'something' "

Josem · 05-08-2009, 09:47 AM

Quote:

Originally Posted by BorisHsArivd

I was wondering how hard it would be to figure out the algorithm if you knew a bunch of the codes. Anyone know? Thanks

There's insufficient information to figure it out just from the codes.

earck · 05-08-2009, 11:24 AM

What happens when I run out of tokens?

SpaceAce · 05-08-2009, 12:00 PM

Quote:

Originally Posted by earck

What happens when I run out of tokens?

You might be joking, but in case you're not:

The "token" is a physical device that simply displays a number. The display usually looks something like a pocket calculator display. You don't run out of tokens because they aren't consumed. You just read the number off your security token and enter it into a form with your username and password.

SpaceAce

SpaceAce · 05-08-2009, 12:03 PM

Quote:

Originally Posted by Josem

There's insufficient information to figure it out just from the codes.

Even if you could figure out the algorithm, you wouldn't be able to get into someone's account unless you also knew the unique internal identifier of his token. Not all token generate the same number at the same time or they would be useless. Each token's generated number takes into consideration the token's unique identity.

SpaceAce

doublebluff · 05-08-2009, 12:04 PM

Quote:

Originally Posted by BorisHsArivd

I was wondering how hard it would be to figure out the algorithm if you knew a bunch of the codes. Anyone know? Thanks

~ 1 : (infinity) odds

Nielsio · 05-09-2009, 12:21 AM

Quote:

Originally Posted by cardman

Has FT stated their intentions on secure tokens? Or is it still radio silence?

Quote:

Originally Posted by FTPDoug

1. No cash game filters

- Still true. Barring catastrophe, this is entering the home stretch of development and will appear in the next major update. I can't give an exact date because that's impossible, but it really is coming.

2. Security procrastination

- We are in no way procrastinating. At least one of the two bigger security projects we're working on will make it into the same update as cash game filters. I'm hopeful we'll get both into the update.

.