Hey All,
I need some advice on this.
We are thinking about using a RSA USB device to provide login details to our website by the means of a certificate.
Here’s a link to the RSA security website provider of the keys
http://www.rsasecurity.com/products/...susbtoken.html
This is my question.
1, Can the website read what’s on a USB Token?
Send in your thoughts on this
Many Thanks
yes it looks like its possible cos i found this
http://www.validy.com
could any one say hows its done ?
A few things I would guess:
1) The card when inserted autoruns a shell on IE, to the website passing the credentials. It might be an HTA application which really customizes the IE, or it might just shell the IE.
2) The user never knows the encrypted login credentials, which are passed to the website. They just know they have a card which allows them access.
3) There may also be an ActiveX or Java component running which secures it even further, or autoplays off the card.
Guess you will have to give them your contact info and get more details from the documentation.