What specific controls does BioPassword implement to prevent the unauthorized capture and replay of user credentials when using the Flash Plug-in?
The BioPassword Flash Plug-in uses two primary control mechanisms to prevent replay attacks. First, keystroke timings are encrypted with the AES algorithm. The AES key is unique per session and sent from the server. This prevents capturing keystroke timings on the client before being sent over an SSL protected connection. Thus, attackers do not have access to clear-text timings. Second, we utilize 3rd party tools to obfuscate our Flash plug-in. This is a complementary control to reduce tampering of the encryption and formatting controls within the Flash plug-in.
