EnigmaKey / How Does It Work?

As the user logs onto the secured website, he is requested to enter his username.  The server issues a challenge to the user.  The user’s computer applies a cryptographic algorithm using the challenge and the keys stored in the security device and generates responses that are sent to the vendor’s server.  Already possessing the matching keys, the challenge and the algorithm, the vendor’s server generates responses and compares them to the ones received from the user. 

 Upon a successful match of responses the server issues a confirmation code for the next step.  The user’s computer, which already possesses the matching information, produces a code and compares it to the one received from the server.  Once the confirmation codes are matched, a website authenticity notification is issued, confirming the legitimacy of the website – ensuring that this is not a “phishing” scheme.  

Even if the user was haphazardly victimized by a Phishing website, there is actually no valid information he could possibly provide that may be adversely used by the crooks.  The User simply does not have or need such information; thus, both the vendor and the user are completely safe and protected.