Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a web developer with a login system (in PHP) that I would like to extend to allow those with a smart card to sign into the system. But I have no idea where to begin and I don't have a massive budget to just throw at this. I'd like to keep the cost under $50. Here are a few areas I've researched but can't seem to find what I'm looking for.

1) I need a smart card. No one seems to sell single smart cards at affordable shipping rates (I'm only finding $2 to $5 for a single card and then $40+ for shipping). Then again, I'm not entirely sure which of the 200 varieties of smart card out there is the correct solution for my application. What sort of smart card should I even be looking at?

2) How to write data to the smart card? I'm only finding card readers out there (Newegg). Do card readers write data as well or is there specialized writer hardware?

3) What steps are necessary to get the data onto the smart card? I'm envisioning data from my PHP application that needs to be written to the smart card and then somehow it gets written then later that data somehow gets sent back to the PHP application. Maybe this isn't how smart cards work, but then again I've never held one in my hands. I'm familiar with 3-track magnetic stripe readers and writers but not smart cards.

4) How to set up the web browser to use the smart card? I found some instructions for Firefox on Windows, but what about other browsers and OSes? I feel like once I've got the actual hardware in my hands, this may or may not be obvious but it seems like it should be clearly spelled out somewhere yet it isn't.

5) How to get PHP to recognize and authenticate the user?

share|improve this question

closed as too broad by TildalWave, Gilles, NULLZ, Xander, Terry Chia Jul 13 '13 at 3:48

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
I've never used a card for this so can't provide a full answer but: 1) Maybe a Java Card? Pretty cheap and relatively easy to get up and running quickly. 2) Google ACS card reader, they're a good brand. 3) Smart card authentication could work where the server provides a card with a random nonce that it signs using a secret key that the card and server both know, send the signed nonce back and have the server check it. P.S. These are for a DYI solution but as with most security things it's better to use a tried and tested system rather than implementing your own. –  Peanut Jun 27 '13 at 16:26
2  
Why a smart card? Why not Google Authenticator, for instance? –  schroeder Jun 27 '13 at 20:19
    
Windows support? –  needsomehelp Jun 28 '13 at 4:15
    
I went through a similar dilemma at my company not too long ago where they wanted two factor auth but didn't want to add to the budget so we used google authenticator. It provides them with two factor auth and since they all have smart phones that the company already pays for and they don't need an extra piece of equipment to lose :) –  Four_0h_Three Jun 28 '13 at 17:19
    
After doing some more research into Google Authenticator, the reason the recommendation was confusing was because it looked like it was only for mobile devices and somehow related only to Google accounts. I think I finally understand how it works and any sign in system could be used with it because it is based on a publicly available IETF RFC. I just need to generate my own secrets and follow the relevant RFC to generate the expiring number on the web server to compare the user's temporary token with. –  needsomehelp Jun 29 '13 at 15:16

Browse other questions tagged or ask your own question.