News reports elsewhere say that the PINs were captured by keyloggers, so their strength (as in difficulty in guessing) was irrelevant. So, either RSA wasn't th

News reports elsewhere say that the PINs were captured by keyloggers, so their strength (as in difficulty in guessing) was irrelevant. So, either RSA wasn't thinking about keyloggers as a component of a combined attack --- even though replay attacks using captured interaction streams are the main threat that SecurID was designed to counter --- or they were being disingenuous.