Reading a certificate on a USB device from an ASP.net website

[carlblanchard]

Hey All,

I need some advice on this.

We are thinking about using a RSA USB device to provide login details to our website by the means of a certificate.

Here’s a link to the RSA security website provider of the keys

http://www.rsasecurity.com/products/...susbtoken.html

This is my question.

1, Can the website read what’s on a USB Token?

Send in your thoughts on this

Many Thanks

[carlblanchard]

yes it looks like its possible cos i found this

http://www.validy.com

could any one say hows its done ?

[nemaroller]

A few things I would guess:

1) The card when inserted autoruns a shell on IE, to the website passing the credentials. It might be an HTA application which really customizes the IE, or it might just shell the IE.

2) The user never knows the encrypted login credentials, which are passed to the website. They just know they have a card which allows them access.

3) There may also be an ActiveX or Java component running which secures it even further, or autoplays off the card.

Guess you will have to give them your contact info and get more details from the documentation.