Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible.

enter image description here

On the reverse of the card is a copyright of 2007, and a co-branding from "InCard Technologies". I used Google, LinkedIn, and a variety of other sites to locate the manufacturer.

Given that the most recent stock price is zero, emails are rejected, and the website is offline I can only assume that they are out of business.

Question

What other manufacturers (if any) allow for HOTP or other custom circuit logic to be embedded into the card?

share|improve this question

1 Answer 1

I don't explicitly know the answer to your sourcing problem, but I do know a bit about the cards and their internals. That being said, I'm pretty sure GIS manufactures them.

There are two classes of card internals:

  • Discrete small pitch surface-mount components embedded inside the plastic.
  • Custom chip-on-board encased in epoxy, again embedded in the plastic.

The first one can be seen by cutting the card's layers apart with a very sharp scalpel. It's tedious work, but you can often find all sorts of interesting internals. You can also "image" the internal layout with a high resolution baggage scanner or similar equipment.

The second one is more difficult to work with. You can cut the card up, but you'll just find a black blob. You can use corrosives to dissolve the epoxy and reverse engineer it, but that's annoying and often damages the internal die.

If you want to build your own, it's actually not hard. Just buy a bunch of tiny SMD components that do the job (they're often significantly thinner than a card), wire them together using thin patch wire, use a dremel to drill down into the guts of an existing card, solder your wires to the card contacts, then use epoxy to fill it. You can use fine sandpaper to flatten it down nicely. It doesn't look very professional, but the card works.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.