News for hackers. Stuff that matters.

A comment on Security Breach Forces RSA to Offer to Replace SecurIDs. Parent comment

Re:Security Breach Forces RSA to Offer to Replace SecurIDs by ams6110 on Monday June 06, 2011 @10:18PM (#2627639)
All the RSA tokens I've ever used had a PIN in combination with the number displayed on the device. So to successfully mimic a device the attacker would need to know the PIN (1:10000 guess) plus the seed for the device.
[ Parent | on HN ]
Re:Security Breach Forces RSA to Offer to Replace SecurIDs by zuppy on Tuesday June 07, 2011 @08:52AM (#2628883)
The pin is only for local access, it doesn't get used to secure the generated code. I know this because I forgot my pin on a vasco device, called my bank and they gave me a code that allowed me to change the pin (and nobody else knows the new pin, not even the bank).
[ Parent | on HN ]
Re:Security Breach Forces RSA to Offer to Replace SecurIDs by anonymous246 on Monday June 06, 2011 @10:51PM (#2627706)
Good point. I had forgotten about the PIN. But that's simply yet another password that amenable to guessing/bruteforcing/keylogging etc. The securid is not vulnerable to such attacks which why is why this crack is a big deal.
[ Parent | on HN ]
Re:Security Breach Forces RSA to Offer to Replace SecurIDs by RockyMcNuts on Monday June 06, 2011 @11:51PM (#2627841)
exactly, I'm paying a lot for working two-factor authentication. If the algorithm generating one factor is known by hackers, and I simply have 2 passwords which the user could have written down somewhere or picked the most obvious or gotten keylogged, then what am I paying for?
[ Parent | on HN ]