As you probably know if you have taken the time to read through my blog, I do a lot with eBay and PayPal. The other week I found out about the PayPal Security Key from Security Now (A TWIT Podcast). Once you get one of these and activate it on PayPal or eBay (or both), it will append a 6-digit number to the end of your password. Cool thing is, this 6-digit code changes every thirty seconds!
Click here to see a picture
The Security Key (no bigger than an average flash drive) will show you what your current code is. This protects you from all kinds of attacks. For example, lets say you enter your ebay or paypal login information and someone sees you enter all of it (by watching over your shoulder or using spyware/keyloggers), including your security code. No problem for you, because the code is only valid for 1 login. Once you login with it, the code changes, even if the thirty seconds is not up.
How about phishing sites. Lets say you accidentally fall for one of these. If you do, no problem. Hurry over to PayPal or eBay and login and the code will change (theirs will no longer be valid). I would change my password if this happens though also. Even if you don’t do that though, the phisher has 30 seconds to get to paypal and login. This is a slight security risk though, as anyone could automate this process with a bot. I’m sure PayPal and eBay though monitor people who try to login many times with different login information.
Those are just two great advantages to it.
So how does it work? Well, I can tell you how I think it works…
The device has an internal clock and runs a special algorithm (unique to your key) based on the current time. When you activate it, buy giving paypal/ebay your SN for the device, they associate the correct algorithm to your account so they know what the current 6-digit code should be whenever you to try to login.
To fix the problem of the device losing/gaining time (as all computers do) their system learns your offset (how much time your device is off) when you login. They can take your code and say, hmm…he normally takes 5 seconds to give us his code, took 7 seconds this time, lets log that…hmm took seven seconds this time also…I think his device has gained two seconds, log it.
That’s my take at it, I’m sure someone could give us a much better explanation. Either way, I do know this. 6 digits = 1 in a million chances of someone who knows your password to get your key right at any given point. Well, almost. Really they have a 1 in 999970 chance (as if you think about it, 30 codes are valid at any given point in time.
So do you want one? Just tell PayPal. It only costs $5 (which covers the shipping costs). They are basically giving them away, you just pay shipping. Visit this link to get yours: http://paypal.com/securitykey/
They ship them USPS First Class from CA. Took 8 days from the day I ordered mine to get it. They say 6-10 days I believe. My suggestion, get it. Even if you do get it, you do not have to use it.
Oh, and as for the battery. Although the battery can not be changed, PayPal says it will last 3-5 years. When you need a new one, they will replace it at no cost to you.
