Now I know / think to know how OTP works with YubiKeys and RSA tokens:
- You get the token, a shared secret with the production server is hardcoded
- You do something with the token and he gives you the OTP (via display or simulated keyboard)
- You send the OTP to your app which in turn asks the manufacturer's server if the code is correct
- You successfully authenticated if the server responded "yes"
Now do actual cards (like the Gemalto MD 830) work the same way, e.g. hard-coding the shared secret andf requiriung online servers by the provider or how does the secret get onto the card?
Furthermore how is the generated OTP moved from the card to the computer? Will it be displayed so the user can copy and paste it? Does it require additional hardware (except for the PC connected reader)? Must it be fetched by the software?
Note: For the paragraph directly above, I'm explicitely talking about cards that don't feature a built-in display.