Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it?

Can you tell me if it's possible to require only the presence of the card + card reader, but no password? All of our devices have a local password already. Is the challenge password something you know or is it based on the LCD screen?

Image of bluetooth smartcard reader

The benefits (as I understand it) was that the Bluetooth connected device (PC, Blackberry) would lock immediately as soon as the RSA token was out of range.

share|improve this question
    
Why not order one and try it out? –  Steve Feb 21 '11 at 17:58
    
I would be equally interested in such devices. Especially, being able to link it with devices other than RIM and preferably with open source and open API-s (something like CCID is for USB readers) You might find this list useful as well: opensc-project.org/opensc/wiki/CardReaders#Bluetoothreaders –  martin Jun 12 '11 at 13:05
    
A youtube video of this device is available at: youtu.be/Cy79-z9L_9I –  makerofthings7 Oct 25 '13 at 15:01

1 Answer 1

Wow. Cool Reader!! I wish I could say I'd tried it, it's very enticing.

From a solid understanding of SmartCards, though, I don't think you are going to get away without entering the password. The password is protecting the keys on the Smart Card, not the usage of the device. These keys need to be protected from use on your device, or any other device - so the lock on your device isn't going to help with the security of the Smart Card. Given how this is written, I expect the password to be a string of characters (upper, lower, number and non-alpha numeric) that can be set at the time of card issuance.

There would be the question of whether you could get an API for your phone to the reader, so that the phone could store the Smart Card password locally - but this becomes a security nightmare quite quickly, as secure storage on a smart phone will be difficult and the ease with which a smart phone can be lost makes storing a password there quite problematic.

share|improve this answer
    
Yes. If possible, the software login/lock should be disabled and instead be linked to the smartcard, which in turn is protected with some PIN. –  pepe Jul 14 '11 at 20:02
    
That would be something to do by modifying (or finding a modification for) the Blackberry OS. With OSes like Windows, you can change the login process to use PKI authentication - where the PKI proof of key comes from the SmartCard - thus the only password you use is the one that unlocks the card. Don't know enough about Blackberry's OS to know if this is even an option. –  bethlakshmi Jul 15 '11 at 13:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.