Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

21–30 of 266 posts

Re: YubiKey 4C

#21

Post by AdamSC1 »

jgrahamc wrote: post #3

Why are Yubikeys so expensive? I have one and use them but the price always gets in the way of having more.

In a lot of cases their clients are businesses who bulk buy the keys, brand them and provide them to their customers either for free or at a discounted price.

Those companies are usually financial services, online games with monthly subscriptions, and corporate IT/Security services. So they have a high customer LTV and the investment is worth it for them.

Yubico was smart to go after that market. It is costly to design, mould, manufacture, sell and support a hardware product, even something as small as this. Since you don't want your 2FA company to go out of business there is good value in knowing they have a stable business model that can actually support a company rather than just burning capital.

Re: YubiKey 4C

#22

Post by jupp0r »

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

Re: YubiKey 4C

#24

Post by Freak_NL »

abhv wrote: post #19

alternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero. but for your family, it is better than nothing and much more cost effective.

> […] there is the possibility of side-channel attacks on the u2fzero.

Interesting. How does that work? Have you any references to that?

Re: YubiKey 4C

#25

Post by ionised »

What are the current alternatives to Yubikey?

Preferably looking for something open-source and in no way associated with Google.

Re: YubiKey 4C

#26

Post by slau »

eecc wrote: post #4

I still don't get how people are ok using these things without a fingerprint reader...

Because biometric authentication is a joke in the security industry?

Biometrics are fine to identify someone. Biometrics, being public data, is not acceptable for authentication nor authorisation.

To use another example:

You get to border control, and present your passport. The agent ensuring that the description in the passport matches the person standing in front of him/her, that is identification. The agent verifying that your passport is genuine and valid, that is authentication. The agent giving you access to a country based on the laws and arrangements between those two countries, that is authorisation.

Anything that can be copied/stolen with a good enough picture or forgotten glass/mug is not good enough for authentication/authorisation.

Re: YubiKey 4C

#27

Post by simias »

serg_chernata wrote: post #7

It looks neat, can someone share personal experience or recommendations? Is this worth it? Is there a better alternative?

I use a Yubikey 4 with the GnuPG smartcard applet to secure all my password, sign my emails and connect to remote computers with SSH. It's super convenient and I'd never go back.

That being said I got a bit concerned about the use of closed source components in newer yubikeys (I believe that the yubikey 4 is open source and the later ones aren't, but don't trust me on that).

For this reason I also bought a nitrokey as a backup. It's a bit slower than the yubikey (I use 4096bit keys) but it works well. I really don't like the plastic cap on the nitrokey though, I feel like I'd lose it within a week if I started using it as my main key. The Yubikey doesn't have any protection at all but it looks sturdy enough that it doesn't really matter. It's been on my keyring for months and it seems to handle the abuse just fine.

Re: YubiKey 4C

#29

Post by Tomdarkness »

abhv wrote: post #19

alternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero. but for your family, it is better than nothing and much more cost effective.

The Yubikey 4 does a lot more than just U2F though.

Re: YubiKey 4C

#30

Post by andresgottlieb »

kentiko wrote: post #17
Nullabillity wrote: post #15

Kind of useless to have a C-only device this early. An A/C-hybrid would be much more useful, like Kingston's MicroDuo[1] series. [1]: http://www.kingston.com/us/usb/personal_business/DTDUO3C

It's an authentication key, not a flash drive.

It's a comment, not a logical proof
Post reply on HN