in the case of a virus infection the cryptographic material can be duplicated and then the PIN can be captured (via keylogging or similar) the next time the user authenticates. If there are attempts made to guess the PIN, it can be detected and logged on the authentication server, which can disable the token. Using asymmetric cryptography also simplifies implementation, since the token client can generate its own key pair and exchange public keys with the server. See also Authentication Electronic authentication Google Authenticator Multi-factor authentication Security token References External links Microsoft to abandon passwords, Banks to Use 2-factor Authentication by End of 2006 Cryptography Computer access control fr:Authentification forte