4 ms·
> Since TUPAS requires no dedicated hardware ... Can you explain this bit? My bank here in the UK has an OTP mechanism for internet access, but it uses a small
by kitd 13y ago
> Since TUPAS requires no dedicated hardware ...
Can you explain this bit? My bank here in the UK has an OTP mechanism for internet access, but it uses a small key generator card provided to each customer, controlled by a PIN on each use.
Does the TUPAS card itself generate the key?
- bergie 13y agoThink of TUPAS like OAuth/FB Connect as envisioned by banks. Typically TUPAS uses a printed card of single-use passwords. Here in Germany you instead get an SMS with a single-use password every time you have to authenticate (for example, to pay a bill). As an alternative German banks also provide smart card reading OTP generators that interface with your bank card: https://www.sparkassen-shop.de/sfp/shop/tan-generatoren,375/ https://www.sparkassen-shop.de/sfp/shop/tan-generatoren,375/ In Finland universities also have the need for federated authentication, as students can take courses in different schools. Instead of TUPAS they standardized on Shibboleth and SAML.
- zokier 13y agoAs I understand it, TUPAS is more of a protocol for providing authentication. Every authentication provider is allowed to implement the authentication at their end however they please. I think some have keyfobs, but afaik majority rely on printed list of OTP codes[1]. If you are familiar how 3-D Secure (eg Verified by Visa, MC SecureCode) works, the process is somewhat similar. So there is no "TUPAS card". [1] example pic: http://imgur.com/Bi5LB06 http://imgur.com/Bi5LB06