Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside Yubikey Neo

hexview.com

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Inside Yubikey Neo

#21

Post by malandrew »

niels_olson wrote: post #6

I accidentally ran over my Yubikey with my Honda Accord, on a key ring with a fin key (1). I dusted it off and it works fine 6 months later. Seriously, if you're in a position where you're using a Yubikey, getting another Yubikey isn't that big a deal for the organization. In fact, if you're a solo practitioner using something like Yubikey, I recommend you get another one and just keep it in a lock box in the event y…

It's actually recommended that you get two yubikeys and connect both to every account and keep the backup safe.

Re: Inside Yubikey Neo

#22

Post by antoinealb »

kweks wrote: post #16

It seems that hardware breakdowns inevitably place a 'raw materials' costing to ojects broken down, often (but less in this instance) - as a somewhat passive-agressive dig at the company: "They sell it for $50, but it's only got $10 worth of components in it!" Outside of the obvious external costs (development, transport, overheads, import, profit, etc), PCB + Tooling costs are often wildly underestimated. For refere…

I would say your 5000 USD for the tooling seem pretty low to me for a steel mold (as opposed to a "soft" aluminium mold). They can easily cost 5-10x more if you factor in mold development.

Re: Inside Yubikey Neo

#23

Post by kweks »

antoinealb wrote: post #22
kweks wrote: post #16

It seems that hardware breakdowns inevitably place a 'raw materials' costing to ojects broken down, often (but less in this instance) - as a somewhat passive-agressive dig at the company: "They sell it for $50, but it's only got $10 worth of components in it!" Outside of the obvious external costs (development, transport, overheads, import, profit, etc), PCB + Tooling costs are often wildly underestimated. For refere…

I would say your 5000 USD for the tooling seem pretty low to me for a steel mold (as opposed to a "soft" aluminium mold). They can easily cost 5-10x more if you factor in mold development.

For full disclosure, I work with factories (Based in China) running plastic injection molding and zinc casting molding.

5kUSD would be a conservative price from our factories; but the item is rather simplistic. As a general rule of thumb, for cases in plastic injection molding, you're correct - you're looking at 10 - 20k easily. Multiple pieces with complicated gating, the price goes up.

Zinc / Metal injection molding involves much more black magic, and this is reflected in the costs.

With all of that said - we're in complete agreement on the main subject - even if tooling cost 5k + 20c per piece, the estimation of $1 for PCBA + PCB Stenciling + molding is way off track, unless it was amortised over tens / hundreds of thousands of pieces.

Re: Inside Yubikey Neo

#24

Post by kweks »

nickpsecurity wrote: post #20
kweks wrote: post #16

It seems that hardware breakdowns inevitably place a 'raw materials' costing to ojects broken down, often (but less in this instance) - as a somewhat passive-agressive dig at the company: "They sell it for $50, but it's only got $10 worth of components in it!" Outside of the obvious external costs (development, transport, overheads, import, profit, etc), PCB + Tooling costs are often wildly underestimated. For refere…

To support your point, most of the delays in the JackPair Kickstarter involve tooling for the casing. The recent one admits they should've talked to an expert before they even settled on the prototype because they had no idea how much trouble it would cause at manufacturing time. Hence, the popularity of the Design for Manufacturing concept these days...

Tooling and injection molding is an arcane art. Most people would be amazed to realise that the tooling to make even the yubikey would probably be around 45cm x 45cm of (almost) solid steel block.

They'd be probably even more surprised to find that it'd cost 10k - 15k to make the tooling.

Diagnosing / 'debugging' issues with injection molding is incredibly difficult - again - it's almost black magic, and it's sadly a skill that's getting harder and harder to find.

If you cast your eyes around your desk / room, we see molded plastic parts every where - so we make the assumption that they must be cheap and easy to do.

And indeed - the assumption of facility due to availability is a very common trap that many kickstart projects fall into.

It's harder to scaffold and pivot in real life ;)

Re: Inside Yubikey Neo

#25

Post by beagle3 »

While we're at it .. are there any other tokens/smartcards that could be used for signing messages (ECC preferable, RSA acceptable)? I only know of YubiKey and the KernelConcepts PGPcard.

Re: Inside Yubikey Neo

#26

Post by justhere4beer »

nickodell wrote: post #12
gruez wrote: post #4

Earlier quoted context omitted.

Hexview provided their reason for believing that. Care to explain why you think otherwise?

Original quote: >That is not a big deal, considering that Levels 1 and 2 of the FIPS140-2 certification are just a marketing gimmick for most electronic devices. They have a point here: technically, the iPhone is FIPS140-1/2 compliant. By itself, that doesn't mean that the device is secure. It does show two important requirements for security.

FIPS isn't trivial. There is a lot of shit crypto on the market, establishing FIPS is not banal. Regardless of FIPS, if not utilized properly, it protects nothing. If utilized correctly, it protects what it needs to. Discounting it show lack of understanding.

Re: Inside Yubikey Neo

#27

Post by justhere4beer »

nickodell wrote: post #12
gruez wrote: post #4

Earlier quoted context omitted.

Hexview provided their reason for believing that. Care to explain why you think otherwise?

Original quote: >That is not a big deal, considering that Levels 1 and 2 of the FIPS140-2 certification are just a marketing gimmick for most electronic devices. They have a point here: technically, the iPhone is FIPS140-1/2 compliant. By itself, that doesn't mean that the device is secure. It does show two important requirements for security.

A little education goes a long way: http://csrc.nist.gov/groups/STM/cmvp/

Re: Inside Yubikey Neo

#28

Post by watersb »

beagle3 wrote: post #25

While we're at it .. are there any other tokens/smartcards that could be used for signing messages (ECC preferable, RSA acceptable)? I only know of YubiKey and the KernelConcepts PGPcard.

I have the Github-branded YubiKey, as well as another U2F FIDO key that I purchased last year from Plug-Up.

But now PlugUp web site, http://pu1.fr, redirects to a trendy, rebranded site that I can't get to work. So I don't know if that vendor exists anymore.

I am excited about YubiCo products. The key I have Just Works, looks and feels very well-made.

Re: Inside Yubikey Neo

#30

Post by beagle3 »

X-Cubed wrote: post #29
beagle3 wrote: post #25

While we're at it .. are there any other tokens/smartcards that could be used for signing messages (ECC preferable, RSA acceptable)? I only know of YubiKey and the KernelConcepts PGPcard.

Nitrokey is another one: https://www.nitrokey.com/

Thanks. Nitrokey looks nice. I'll have to look deeper into the github repo to see what it actually supports in hardware though - the website does not mention the smartcard standards that are actually supported.
Post reply on HN