Hacker News Reader

OK, it's clearly junk crypto, but do you know enough to explain exactly what went wrong?

I heard something about being able to generate private keys from the serial numbers of the tokens, but even if that's the case, you'd need to know what token/serial number you acutally care about. Not all users are going to have access to anything interesting.

View on HN

FTA lawnchair_larry linked to:

He said the initial RSA attack was followed by malware and phishing campaigns seeking specific data that would link tokens to end-users, which meant the current attacks may have been carried out by the same hackers.

You also need to get the PIN that the specific user is using in addition to the access code from the token. You can use it without a PIN but that is reducing it to a single factor auth solution.

Reply on news.ycombinator.com