<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 28 Mar 2011, at 13:22, John Lamb wrote:</div><blockquote type="cite"><div><font class="Apple-style-span" color="#000000"><br></font>If an attacker had all the seeds issued to an organisation, then they could<br>identify your token by capturing the current number on your SecurID at a known<br>time and comparing it to a generated list of the numbers all the issued tokens<br>would have been displaying at that time. </div></blockquote><br></div><div>Well, for a large organisation they might need two values to narrow it right down. SecureID allows for some clock drift because the tokens aren't hugely accurate. One value might only narrow things down to about one in one thousand (there will be some tokens displaying the same value, and the clocks are also drifting). Two values gets you about one in a million.</div><div><br></div><div>ian</div><div><br></div></body></html>