Unit installation

18-4

Example:

186 003 1 6 3 ABCABC ; user 003, enabled, level 3, password ABCABC

187 003 ; request to login

; controller responds with "Please enter 2, 6, 3"

187 B C C ; enter 2nd, 6th, and 3rd digit of password

; controller responds with logon message

Command 186 told the controller that user 003 wanted a 3 digit challenge password of ABCABC.

"Command 187 003" told the controller that user 003 was trying to login. The controller knew

(because of command 186) that user 003 needed a three digit challenge. It randomly chose to ask

for the 2nd, 6th, and 3rd digit of the password. After the controller issues such a challenge, the

next time command 187 is executed, it should be the answer to the challenge. In this case, user 003

entered the three digits that the challenge asked for, as you can see below:

Requested digits: 1 2 3 4 5 6

Password digits: A B C A B C

The 2nd, 6th and 3rd digit of the password are "B C C".

The challenge password method is more secure than the fixed password method, because if

someone decodes your DTMF digits as you enter your password, they don't learn your entire

password, but only those digits they you enter. If they try to logon using your password, the

challenge will likely ask for a digits they don't know.

The challenge will never ask for the same digit twice, so the challenge can't ask for more digits than

the length of your password. For the most security, it is recommended that you use at least six and

preferably eight digits (the maximum length) for your password and have the challenge ask for

three or four digits.

Method #4 - Challenge Passwords with Decoy Digits:

While the method #3 is very secure, if someone decodes your DTMF digits as you log on many

times, they will eventually learn all of the digits of your password. Using "decoy digits" makes it

much more difficult to figure out a password by decoding the digits.

The controller doesn't require you to enter decoy digits, but it allows it if you have a challenge

password. Consider the challenge password that was set up for user 003 in the example

for method #3.

187 003 ; request to login

; controller responds with "Please enter 2, 6, 3"

Now instead of entering: "187 B C C" like with method #3, enter"187 5 3 A B C C B". Note that

"B C C" still appears in the digits entered. The other digits ("5 3 A" and the final "B") are

not needed; they are just "decoy" digits and are ignored by the controller. But someone decoding