so they don't exactly set it up for you... interesting. and if your battery is defective and dies early (but after you've "synch'd" it), i suppose you can just call them and give them your social security number and/or the town where you were born or mother's maiden name or something and they'll reset that layer of your security for you. there are always loopholes, i guess....

Thanks, kansieo. and welcome to itT!

And a countdown too - 8...7...6 seconds to self-destruction kind of thing - otherwise what kind of a self-destruction is it ? Any self-respecting 'self-destructing' routine should have a countdown and some pyrotechnics and smoke to go with it ...

:-)

Even the "Mission Impossible" tape player gave off a bit of smoke when it destructed. I believe a puff of smoke is not too much to ask so you are assured that it has destructed.

Old thread - but here's how I think it works.

I don't think it's anything like a SecureID, beyond it having a battery (which has already been mentioned), what appears to be a multi-character 7-seg ChLCD (http://en.wikipedia.org/wiki/Cholesteric_liquid_crystal), and a microcontroller of some sort.

On the front there are smartcard contacts, probably for programming the card. The way I think it works is basically it's an electronic version of PPP - Perfect Paper Passwords (https://www.grc.com/ppp.htm). The microcontroller's memory is simply programmed (via the smartcard interface) with a huge generated list of these passwords, and the list is tied to your account as well.

You press the button, it pulls the next PPP token from the list, displays it on the LCD, and then sets a flag bit saying "this token is used" (a similar flag bit is set on the server side as well on its list). If the token matches the free (non-flagged) token on the server, then access is granted. If it doesn't match, access isn't granted. Either way, the token on the server is flagged as "used" - so it can't be reused.

Such a system would require very little memory; only 20 bits per entry in the list. Flagging the token wouldn't necessarily need another bit: Just reset the number higher than the 6 digits but within the 20 bit space, and call that "flagged". As a bonus, it destroys the original value in the memory cell (extra security?). With 32K of flash RAM or similar SRAM onboard, it could hold 13000+ tokens. Even if you used the card 4 times a day, it would still be able to supply tokens for over 8 years. The battery would likely be dead long before that.