Does anyone know how this works? It reminds me of a RSA SecurID but since it's only in software, can't it be reverse engineered?