Timeline for Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 28, 2013 at 1:43 | history | edited | Eric G |
edited tags
|
|
| Mar 27, 2013 at 23:14 | review | First posts | |||
| Mar 28, 2013 at 1:43 | |||||
| Mar 27, 2013 at 14:10 | answer | added | Tom Leek | timeline score: 3 | |
| Mar 27, 2013 at 13:49 | history | edited | Simon | CC BY-SA 3.0 |
added more information
|
| Mar 27, 2013 at 13:46 | comment | added | AJ Henderson | ah, ok, so that is more or less fitting with my b) scenario. I guess that works ok since it still ensures the card is present and can't be reproduced without the card and the pin to unlock the card isn't around. Alright, I just had to finish thinking it through. | |
| Mar 27, 2013 at 13:27 | comment | added | Simon | Well maybe i should explain what we want to use it for. We want to use two factor authentication to log on to our system. The employes will get SmartCards with authentication certificates on them. The SmartCard is protected by a PIN/Password. The user will 1. insert the card 2. enter the card PIN/password (preferably locally) 3. enter the password for the certificate (on the computer). We made tests with external readers similar to the one I mentioned above and the local handling of the unlock by PIN worked fine. Now we are looking for a way to remove the "extra device" on the table. | |
| Mar 27, 2013 at 13:13 | comment | added | AJ Henderson | the point of that device is Payment capture. It is either a) communicating the payment information directly to the payment gateway (thus bypassing the computer completely), b) being given a transaction to sign and signing it or c) passing the payment information after unlock. I suppose that authentication could be accomplished by doing a challenge/response signing, but it would open the door for something other than the login to provide the challenge. | |
| Mar 27, 2013 at 13:08 | comment | added | Simon | How would it be more difficult to implement than the Secure PIN Entry (SPE) in the following device: acs.com.hk/index.php?pid=product&id=acr83 ? | |
| Mar 27, 2013 at 12:57 | comment | added | AJ Henderson | This would be difficult to implement to be more secure than doing it on a computer itself. How does the keyboard transmit the all clear to the computer? What prevents this signal from being cloned? I suppose it might be possible to use the keyboard to directly unlock the card and then have the card handle the connection, but it sounds like it would be pretty difficult to setup and might introduce risks about attacks convincing a smart card to authenticate something you didn't want to authenticate (since it is unlocked by different hardware than it is authenticating to). | |
| Mar 27, 2013 at 10:35 | history | asked | Simon | CC BY-SA 3.0 |