Security Token Battery Life?

[Ryuko]

I believe the 'old' codes are saved on the token as well as the server. The server records it as 'used' and the token saves it as 'used' so that it never tries to use the same code again. I don't think it would take a lot of space... Let's assume you log on once a day... that's only 365 codes for one year. I'm sure the token could save thousands of codes with the smallest chip imaginable.

As far as it turning off/on with the same code... I've had it go both ways for me (give me the same code, give me a different code). I believe there is an internal timer giving you a certain amount to record down the code that was just generated, but I don't think it's timed on an external basis. Clocks fall off rhythm all the time. It just seems like a terrible thing to rely on.

The whole idea is... algorithms are hard to break, especially if someone has such a small sample size of codes to go by. So, even if someone could get a hold of a list of your old codes, I doubt they would put enough effort in to crack a person's individual algorithm.

[Raldo]

Remember your old NES games? You know how some of them have a save file? That save file only exists because there's a little battery inside constantly powering what little RAM it has so it doesn't lose your data. Most (all?) of my NES games still have their save data after all these years. I don't know how an NES battery power/size compares to the one in the security token, nor do I know whether they sap the same amount of energy constantly. Assuming that they are similar in both those regards, your security token probably has a good 20+ years of life.

Answers to other misc. stuff that's been brought up:

1) The codes are generated using an algorithm, the current time, and the long number on the back of the token.

2) The 30 seconds SE mentioned was in reference to the fact that the token will generate a new code approximately every 30 seconds. Continually press the button on it, you'll get the same number most of the time, but every 30 seconds or so, it'll be a new one.

3) The reason why your codes are valid for an extended period of time is because, like the person above stated, clocks fall out of rhythm after a while, and the tokens have no way of knowing. It's far safer to let your codes last for ~10 minutes than it is to have an angry mob of people beating down your door because they can't log in for reasons they don't understand.

[JackDaniels]

You know how the security token screen turns off after a few seconds, well I spilt coffee on mine and now it stays on until I press the button again. I prefer it this way so I guess it worked out. I just hope I don't forget to turn it off sorry off topic but I felt like sharing and it didn't require its own thread lol.