Anyone know how those net bank number generators work?

[Rum]

For the last year and a half I have accessed my bank account on line using a little number pad that they sent me. I go to the web site type in a couple of passwords, then type a pre-set number (chosen by me when I set the thing up) into the little pad thing and it them generates a number (different every time) which I type into the window thing on the site and it lets me in. It would seem that somehow the device communicates with the web site, but that isn't possible..is it?

It has puzzled the hell out of me how this actually works. What's going on here!?

[Animavore]

It's a secret.

[Azathoth]

http://en.wikipedia.org/wiki/Security_token

[PsychoSerenity]

It's a secret.

And if anyone ever figures it out they'll be able to steal all the money. It's the plot of the next James Bond movie.

[Xamonas Chegwé]

If it's the same as mine, your online banking page gives you a number which you key into the reader. The reader then gives you another number which you type into the online page to complete the transaction.

What happens is that the reader uses the random number from your bank, your PIN number and your card number as input to a complex calculation which then generates an output number. Your online bank also knows the calculation method and generates the same output, which is compared to what you type in.

There are variations on this method - but that is the gist of it.

[Rum]

Thanks XC. The thing is with mine I have a four digit number - one I chose when I get the thing and I enter every time on the gizmo. I set it up on the little gizmo so the bank can't know what that number is. I type that same number into the gizmo every time and it churns out a six digit 'random' number . I can't see how the banks encryption system has enough info from my end to accept my number.

I suspect quantum magic shit.

[Azathoth]

Public key encryption. This little graphic explains it pretty well

[mistermack]

I've got the same gadget. You put the card in, generate the number, and the bank's computer lets you in.

I assume that the bank's computer is programmed with the numbers that your card/gadget will generate at that time, on that date. So the required set of numbers for your account might be changing every five minutes. Or every hour.

That's just a guess on my part.

Of course, the reader must have an internal clock, if that's the case. Not really a problem. I don't see a place for a battery on mine. I suppose they replace them before the battery expires.

[Pappa]

Public key encryption. This little graphic explains it pretty well

So... if you type in "brown", it'll always work?

[JimC]

Romanian gypsy criminal gangs do...