SecurID has also been proven to be insufficient - if the perpetrator gets his hands on one and logs a few of the numbers then it's possible to digest those and predict the future numbers
Could you provide some citations for that please? To my knowledge this is just not possible.
Salts don't protect against brute-forcing of hashes; they protect against rainbow tables. You still need to store that hash somewhere!
Surely the problem is that you're assuming sqrt(1) = 1 when actually it is +- 1? You're throwing away the sign change in that step
"The Mets were great in 'sixty eight, The Cards were fine in 'sixty nine, But the Cubs will be heavenly in nineteen and seventy." -- Ernie Banks
