any math expert here that can count the number of combinations for the 4x4 case?

This is done, and no change to the servers are required: this key-chain device stores and sends the password for you. You don't need to trust your laptop or the device that connects to the internet since the password is sent encrypted (a you don't type it). By using a display built into the device, you know where you're sending the password to. As said It works with existing sites, see it in action for Twitter: http://identivasecurity.com/ Disclaimer: I'm one of the two developers