suggestions for smart card or biometric web authentication?

Anyone have suggestions for biometric or smart card or key fob or [whatever
else] authentication of a future public facing website? For example, a
customer could do something to authenticate themselves and the computer
passes some data in the background of their browser session so a user can be
authenticated better than the typical "username/password" fields? We'd use
ASP.NET 2.0 on the server side. I see a few miscellaneous tools in a google
search but nothing is jumping out at me. For example, one is not really
..NET compatible but you could work around that. Not great. We also need
something affordable. Considering that online banking sites are exploring
better options to prevent spyware from grabbing usernames/passwords, I was
hoping someone in this group might have done some research into this already
and have some concrete thoughts or suggestions.

User Group Etiquette: Please don't be the first to reply to this post
unless you have something truly helpful to add, else others will think I've
already been helped and not read the post.HK:

You can have a look at our opensource two-factor authentication
solution:

http://www.wikidsystems.net (or
https://sourceforge.net/projects/wikid-twofactor/) and our commercial
site: http://www.wikidsystems.com.

We currently have a COM object for windows apps, but we're also working
on an ISAPI plugin.

In addition, the PC clients for mac, linux and windows can do mutual
authentication - i.e. host & user auth, which prevents MITM attacks. It
can run on a usb device. The commercial version supports wireless
devices - Blackberry, cell phones, Palm, WindowsMobile.

suggestions for smart card or biometric web authentication?

Anyone have suggestions for biometric or smart card or key fob or [whatever
else] authentication of a future public facing website? For example, a
customer could do something to authenticate themselves and the computer
passes some data in the background of their browser session so a user can be
authenticated better than the typical "username/password" fields? We'd use
ASP.NET 2.0 on the server side. I see a few miscellaneous tools in a google
search but nothing is jumping out at me. For example, one is not really
.NET compatible but you could work around that. Not great. We also need
something affordable. Considering that online banking sites are exploring
better options to prevent spyware from grabbing usernames/passwords, I was
hoping someone in this group might have done some research into this already
and have some concrete thoughts or suggestions.
User Group Etiquette: Please don't be the first to reply to this post
unless you have something truly helpful to add, else others will think I've
already been helped and not read the post."HK" <replywithingroup@.notreal.com> wrote in
news:ZHhtf.6970$pE4.4961@.tornado.socal.rr.com:

> Anyone have suggestions for biometric or smart card or key fob or
> [whatever else] authentication of a future public facing website?
Biometrics is still in its infancy - at least for the web.
As for keyfobs, take a look at RSA Security's SecureID authentication.
Also Entrust provides secure identity solutions.
SecurID needs a bit of fudging to work with ASP.NET:
http://sourceforge.net/projects/securid4dotnet/
A cheaper solution maybe to use client-side certificates. You send a
certificate to each user:
http://support.microsoft.com/defaul...b;EN-US;Q315588
So to authentication, a user will need a password + certificate.
But I guess a bigger question is - are you going to provide all your
customers keyfobs or biometric readers? This stuff doesn't come cheap.
Also, are you willing to deal with all the support issues? Perhaps you
should consider building better logging/monitoring tools - and force
users to reset there passwords often?

> User Group Etiquette: Please don't be the first to reply to this post
> unless you have something truly helpful to add, else others will think
> I've already been helped and not read the post.
Newsgroup (usenet)... not user group!
Anyhow, I don't think there is such an "etiquette" rule. What one
considers junk maybe gold for another? : ) You can always repost if you
don't like the answers!
Stan Kee (spamhoneypot@.rogers.com)
HK:
You can have a look at our opensource two-factor authentication
solution:
http://www.wikidsystems.net (or
https://sourceforge.net/projects/wikid-twofactor/) and our commercial
site: http://www.wikidsystems.com.
We currently have a COM object for windows apps, but we're also working
on an ISAPI plugin.
In addition, the PC clients for mac, linux and windows can do mutual
authentication - i.e. host & user auth, which prevents MITM attacks. It
can run on a usb device. The commercial version supports wireless
devices - Blackberry, cell phones, Palm, WindowsMobile.

Suppress Form Action

A custom server control has a Button.

Namespace Confirm
Public Class ShowConfirm : Inherits Button
Private strConfirmMsg As String
Public Property ConfirmMessage() As String
Get
ConfirmMessage = strConfirmMsg
End Get
Set(ByVal value As String)
strConfirmMsg = value
End Set
End Property

Protected Overrides Sub AddAttributesToRender(ByVal Output As HtmlTextWriter)
MyBase.AddAttributesToRender(Output)
Output.AddAttribute(HtmlTextWriterAttribute.OnClick, "ConfirmMsg()")
End Sub

Protected Overrides Sub RenderContents(ByVal Output As HtmlTextWriter)
Output.Write(vbCrLf)
Output.Write("<script language='JavaScript'>")
Output.Write(vbCrLf)
Output.Write("function ConfirmMsg(){")
Output.Write(vbCrLf)
Output.Write("var answer = confirm('")
Output.Write(strConfirmMsg)
Output.Write("')")
Output.Write(vbCrLf)

Output.Write("location.href = window.location.href + '?Proceed=' + answer")
Output.Write(vbCrLf)
Output.Write("}")
Output.Write(vbCrLf)
Output.Write("</script>")
End Sub
End Class
End Namespace

Using VBC, I compiled the above intoConfirm.dll. This is how I am using the above custom control in an ASPX page (assume that the ASPX page is namedConfirm.aspx):

<%@dotnet.itags.org. Register Assembly="Confirm" Namespace="Confirm" TagPrefix="CC" %
<form EnableViewState="true" runat="server">
<CC:ShowConfirm ID="ShowConfirm1" ConfirmMessage="WANNA EXIT?" Text="EXIT" runat="server"/>
</form>

Note the

Output.Write("location.href = window.location.href + '?Proceed=' + answer")

line (which is highlighted) in the VB class file code. When the ASPX page gets rendered, it displays a Button. Conventionally, when a Button is clicked in an ASPX page, it posts back to itself using the POST method. When the Button in the above custom control is clicked, a JavaScriptconfirm dialog pops-up with 2 buttons -OK &Cancel. IfOK is clicked, the value of the JavaScript variableanswer istrue & ifCancel is clicked, the value of the variableanswer isfalse.

What I want is irrespective of whether a user clicks theOK orCancel button in theconfirm dialog, instead of posting back to itself using the conventional POST method, I want the ASPX page to post to itself BUT with a querystringProceed=<value> appended i.e. I want to suppress the conventional post & instead add the querystring so that I can find out whether the user has clicked theOK button or theCancel button in theconfirm dialog. If the user clicksOK, he will be taken to

http://myserver/aspx/Confirm.aspx?Proceed=true

On the other hand, if the user clicksCancel in theconfirm dialog, he will be taken to

http://myserver/aspx/Confirm.aspx?Proceed=false

Can this be done in anyway?

Output.AddAttribute(HtmlTextWriterAttribute.OnClick, "ConfirmMsg();return false;")

Thanks, mate, your suggestion turned out to be a great one. Could you please tell me what role doesreturn=false; which you have appended afterConfirmMsg(), play here?

Going by your suggestion does add the querystringProceed=<value> at the end of the URL but there's a *** here. Suppose when a user clicks the server-side Button; he is shown the JavaScriptconfirm dialog with theOK &Cancel buttons. If the user clicksOK, then he is taken to

http://myserver/aspx/Confirm.aspx?Proceed=true

That's fine but if the user clicks the server-side Button once again & clicksCancel in theconfirm dialog, then he is taken to

http://myserver/aspx/Confirm.aspx?Proceed=true?Proceed=false

i.e. the querystring gets appended twice. In other words, a querystringProceed=<value> will go on getting appended at the URL wheneverOK &Cancel is clicked in the JavaScriptconfirm dialog. For e.g. if a user clicks eitherOK orCancel in theconfirm dialog 5 times, then the querystring will get appended one after the other 5 times.

Any workaround to overcome this?

survey

How can i design a public survey in asp.net writing with c#??Hi !!

Can you expand more and explain what you want it to include or how the application should behave? (more explanation please, i might be able to help)
There is a free survey product for ASP.NET:NSurvey.

FYI: Your question is so broad its not much different than asking "how do you write a Word Processor"? You need a lot of knowledge and programming skills to build complete solutions like this. Its the kind of thing you generally hire experts to handle.
I will prepare it in asp.net with c# first..It will include 3 parts..Questions, answers and answer's options...How can i model these parts in database first?Some people told me to use normalization...but i dont know how??please help me...
It genuinely sounds like you need an education in database design.

asp.net forums is not hear as a classroom to teach you. We cannot start writing entire courses of subjects. We cannot guess what you know so we can tune our tutorial to you.

If you cannot find a course, seek out books on the subject. Also search the web for articles. After all, there are people who have written educational articles on many subjects. (Please don't ask me to direct you to the articles. I expect you to search the web because that's how I do find things on the web.)

asp.net forums can give you short answers that move you forward. If I told you "normalization is a way to reduce the size of records by extracting their common parts into a new table", how far will that get you with your current level of inexperience?

People have high paying jobs creating databases and software applications. Frankly, its a little frustrating for others to demand we mentor in these forums instead of getting a real education.

Going back to my original response: there is a FREE survey package available for ASP.NET: nsurvey.