How's dongle key security?

do you use hardware keys to limit site access?

[bill]

A company I work for has recently introduced the idea of requiring employees to carry one of those little USB key devices for network security. As it has been explained to me the use of these hardware keys combined with passwords will be requirements to log into the network and view Intranet sites. This is still in the planning stages but I wanted to hear whether any of you have experience with this.

First, how secure are these keys? I was told that the keys are secure because they can't be duplicated. That sounds a bit odd to me as I'm assuming these keys are just memory cards and anyone can copy the contents.

Next, how would you maintain a network of hardware keys? I could understand on an office basis, but what happens when you go nationally, and internationally? I know what a PITA i is to maintain a list of passwords for a server login...it sounds like a real burden moving to hardware keys.

Then, how would you compare the benefits of a system like this compared to using a digital form of security? I'm a fan of encryption like PGP. I'd love to promote a system like that, but I'm not the one who makes these decisions unfortunately.

I'd like to hear what you think and what your experiences have been. This is new territory for me.

[postmaster]

It probably wouldn't hurt to get the identities of the employees verified through at trusted third party. Thawte has a web of trust system in place. Check it out when you get a chance.

[bufferzone]

They are quit secure, Not because the key can’t be copied, of course they can, all data can be copied, but because they combine something you have (the usb key) with something you know (your password). Simply copying the key will get you no where, you need to get the password also, and the fact that you need both gives you the better security.

If you require more security then this, you can add a third element. The newest trend are security through something you are, also called biometrics. They work with fingerprints, iris scans, scans of facial vascular patterns, even DNA scans. You can by USB keys with a fingerprint scanner in them, this way, only the owner can use the usb key, and he needs to hold it when the computer is reading the electronically passkey