Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

How does the 6 digit randomly generated security code from (disconnected) Verisign Identity Protection card help in verification/validation of any user?

Why one cannot enter any random 6 digit value instead of generating that value from VIP card/device?

Is there any fixed pattern of getting those values from that VIP device/card so that the server can verify that number?

share|improve this question

marked as duplicate by Xander, Noordung, Adnan, Rory Alsop Jul 7 at 11:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

You need to read about MFA tokens.

The numbers are sync'ed between the card and the authentication server. They have to match and they change. As part of the algorithm to generate the number, there is info from the device itself (serial number) so that the system knows that the number is associated with a unique device (yours). Mixed with your credentials, you have a very strong authentication scheme.

What benefit would it be to type any random string? It has to match SOMETHING on the server for it to mean anything.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.