Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico is merging with ACQ Bure and intends to go public

yubico.com

Post reply on HN
Print view View original

31–40 of 222 posts

Re: Yubico is merging with ACQ Bure and intends to go public

#31

Post by woodruffw »

no_time wrote: post #17
dboreham wrote: post #8

Time for an open source u2f token.

The idea of authenticator hardware is inherently hostile to DIY and open source because you cannot produce or extract a keypair to generate valid attestation statements. Unless you are part of the cartel of course. https://w3c.github.io/webauthn/#attestation-statement

WebAuthn doesn’t require the RP to enforce any particular hardware attestation, and many sites (the overwhelmingly majority?) allow anonymous attestation, self-attestation, or simply no attestation at all.

Having hard-to-extract device keys isn’t “DIY hostile”; it’s critical to the attestation security model. If you want to build your own WebAuthn authenticator, then you can either form your attestation root (there’s no “blessed” vendor list that I know of) or simply ignore that part of the spec.

Re: Yubico is merging with ACQ Bure and intends to go public

#33

Post by bschne »

JoachimS wrote: post #25
bschne wrote: post #11

Earlier quoted context omitted.

Do you mean Swiss (classic!) or was there another one? https://en.wikipedia.org/wiki/Crypto_AG

Though started by the Swede Boris Hagelin. https://en.wikipedia.org/wiki/Boris_Hagelin

Ah, true, I forgot!

Re: Yubico is merging with ACQ Bure and intends to go public

#34

Post by aborsy »

bberrry wrote: post #5
aborsy wrote: post #2

Anyone has insights into how trustworthy is Yubico? Their firmware is opaque, not shared outside the company, so is their hardware (important for RNGs etc).

Very. They are a tiny Swedish company that pay for top talent, are quite active and hands-on in the netsec community. It's not a faceless corporation with a Chinese PO Box.

Thanks for the info!

The construction quality of Yubikeys has been good in my experience.

I was just worried about the closed source proprietary firmware in a security product (including the random number generators, where issues were discovered in the past).

But Yubikeys are used in various companies and apparently in some branches of governments too, thus must have been vetted by their security teams (though there could be different lines of firmware or products for different clients. People say there is not much benefit to purchasing FIPS-compliant Yubikeys. Neglecting the approved algorithms and features, is the firmware the same as that in non-FIPS security keys?)

Re: Yubico is merging with ACQ Bure and intends to go public

#35

Post by pavlov »

rekttrader wrote: post #29
Raed667 wrote: post #21

Earlier quoted context omitted.

The fact this is not only legal, but common practice baffles me ...

It’s a more transparent and less predatory than venture capital.

Is it? VCs don’t raise money from “mom and pop and Reddit” retail investors, but SPACs have enabled insiders to sell stock at $10 that often ends up being worth less than $1 or even bankrupt just a year or two later. These often included a social media pump like the SPACs promoted by “SPAC king” Chamath Palihapitiya.

However the companies that go public via SPAC are mostly VC-funded, so in that sense you’re right that they’re also profiting from the SPAC con by being able to dump their holdings in these companies that were not actually ready to go public.

Re: Yubico is merging with ACQ Bure and intends to go public

#36

Post by xarope »

rootio wrote: post #15
dboreham wrote: post #8

Time for an open source u2f token.

Like SoloKeys? The Solo 2 has a firmware written in Rust: https://solokeys.com

Anybody have a solokey, or have some feedback? I wanted to buy some, but the comments about bent connectors put me off, as well as the supply issues for usb-c

Re: Yubico is merging with ACQ Bure and intends to go public

#37

Post by panny »

neilv wrote: post #23
dumpster_fire wrote: post #7

I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going public is taking that worry even further. Make keys, sell keys. The end. What's there to raise funding for? Build yet another password vault?

For personal use, I just tried to buy a few pre-SPAC units, just in case. But they seem to no longer sell any plain non-NFC USB-A keychain models.

>pre-SPAC

?

Re: Yubico is merging with ACQ Bure and intends to go public

#38

Post by bhawks »

Raed667 wrote: post #21
pavlov wrote: post #14

Earlier quoted context omitted.

This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). It has no operations, it just holds a bunch of money put in by investors who want to find a private company that wants to go public.

The fact this is not only legal, but common practice baffles me ...

It's faster and cheaper, those are things that are generally considered valuable.

Faster: the finance markets have been extremely tenuous the past 4 years between pandemics, supply chain crisis, world wars, inflation, and so on. An IPO requires 12 to 18 months of work / process before listing. SPACs can be done in a quarter or 2. In uncertain times it is much less risky to get the listing done fast.

Cheaper: Startups pay much less in fees to investment bankers when going through SPACs, there is also less dilution for investors and employees and more valuation transparency. In traditional IPOs investment bank underwriters have some conflict of interest to get lower valuations to pass the 'pump' onto their high value clients or proprietary trading desk. Why should they benefit over the people who have literally built the company?

While it is true that there is room to better regulate SPACs, there haven't been horrible abuses yet. It is also true that SPACs have not had the best returns for retail investors over the past few years however drawing a conclusion that this is due to SPAC usage versus the complex macro economic environment of recent years is very difficult.

Re: Yubico is merging with ACQ Bure and intends to go public

#39

Post by lordnacho »

pavlov wrote: post #14
dumpster_fire wrote: post #7

I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going public is taking that worry even further. Make keys, sell keys. The end. What's there to raise funding for? Build yet another password vault?

This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). It has no operations, it just holds a bunch of money put in by investors who want to find a private company that wants to go public.

Doesn't change the fact that your incentives as a public company are different.

Also all the people who built the company in the first place will cash out. People can decide for themselves whether they think the product will become more or less secure from this.

Re: Yubico is merging with ACQ Bure and intends to go public

#40

Post by neilv »

panny wrote: post #37
neilv wrote: post #23

Earlier quoted context omitted.

For personal use, I just tried to buy a few pre-SPAC units, just in case. But they seem to no longer sell any plain non-NFC USB-A keychain models.

>pre-SPAC ?

Before this ACQ Bure deal, in case quality, features, trustworthiness, or pricing change.
Post reply on HN