Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico is merging with ACQ Bure and intends to go public

yubico.com

Post reply on HN
Print view View original

71–80 of 222 posts

Re: Yubico is merging with ACQ Bure and intends to go public

#71

Post by adql »

jtvjan wrote: post #55
JoachimS wrote: post #30

Earlier quoted context omitted.

If you are looking for a tiny, Swedish company working in a similar area as Yubico, there is Tillits AB. Tillitis is a spin off from the Swedish VPN provider Mullvad. In contrast to Yubikeys, The Tillitis TKey as well as tools, device verification etc is 100% open source. https://tillitis.se/ https://github.com/tillitis https://mullvad.net/en (Full disclosure: I work for Tillitis.)

The key costs 880 SEK. That's about 78 euros or 85 dollars. It's designed to be future proof, with applications being uploaded to the device by the host. The website feels a bit cramped with all the large text on desktop, like it was only tested on phones

the background makes it badly readable on phones too

Re: Yubico is merging with ACQ Bure and intends to go public

#72

Post by adql »

no_time wrote: post #63
woodruffw wrote: post #31

Earlier quoted context omitted.

WebAuthn doesn’t require the RP to enforce any particular hardware attestation, and many sites (the overwhelmingly majority?) allow anonymous attestation, self-attestation, or simply no attestation at all. Having hard-to-extract device keys isn’t “DIY hostile”; it’s critical to the attestation security model. If you want to build your own WebAuthn authenticator, then you can either form your attestation root (there’s…

I am aware how attestation works and what problem it addresses. But I strongly believe the power imbalance it creates outweighs the benefits. Especially with bullshit like CF using it as a captcha substitute. https://blog.cloudflare.com/introducing-cryptographic-attest...

This fucking article.

CF, WHICH IS THE FUCKING SOURCE OF THIS PROBLEM, complains about the problem

Re: Yubico is merging with ACQ Bure and intends to go public

#73

Post by red_admiral »

munchbunny wrote: post #48
rmccue wrote: post #4

(ACQ Bure is a SPAC.)

Interesting that Yubico is choosing to go public via SPAC. It’s lower scrutiny, it became more popular over the last few years, and then lost some popularity because of high profile duds. Why go with a SPAC in that environment if the business is healthy and profitable?

Because, as far as I know, the business is not hugely profitable and there's not much scope to change that. Yubico makes a product that is high quality, does exactly what it says on the tin, does not come with any integrated ads/AI or anything else like that, but in the grand scheme of things is fairly niche (I wonder how many people outside of the tech and perhaps gov sectors would even recognise the company name).

There's simply no way they can line up the "here's how we get to 1B users and then mine all their personal data" business plan that some other tech companies can do.

Re: Yubico is merging with ACQ Bure and intends to go public

#74

Post by adql »

cinntaile wrote: post #6
nikanj wrote: post #3

Time to crank the monetizing tap, add a mandatory monthly subscription to everything and deprecate well-working gear

You could buy a programmable open source security key instead, they recently opened their shop. https://tillitis.se/ Some of the people behind Mullvad VPN are associated with it.

That site is fucking garbage, and there doesn't even see to be a dock on what it supports.

Like, programmable key is cool as an idea but I need smartcard support and a button on it to confirm transaction to replace YK usage...

Re: Yubico is merging with ACQ Bure and intends to go public

#75

Post by dathinab »

cinntaile wrote: post #6
nikanj wrote: post #3

Time to crank the monetizing tap, add a mandatory monthly subscription to everything and deprecate well-working gear

You could buy a programmable open source security key instead, they recently opened their shop. https://tillitis.se/ Some of the people behind Mullvad VPN are associated with it.

Tillitis TKeys are very interesting but not yet a full replacement for Yubi in multiple aspects:

- they don't (yet) have all the features, or at least I couldn't find out how to do some of them without implementing them myself. Through due to the design of the TKey this can be added later without needing a new key or anything like that, you could even implement it yourself

- their design approach is a bit different from a Yubikey or similar, mainly it doesn't have any persistent (writable) memory. This has some drawbacks and some benefits. Benefits include that you can add applications later on, have endless many of them, and upgrade applications. E.g. a company handing this key out to 1000 employees and needs to switch to post quantum cryptography doesn't need to buy 1000 new keys, they just deploy an update and the users have to re-enroll their existing keys. Drawbacks include that you can't store anything on the key (TOTP, moving a OpenPGP key onto a Yubi key etc.) so for some appliances you need to have some metadata on the device where you want to use the key with (could be encrypted using the TKey, might just be a seed or similar to derive the right data using the TKey, etc.). Not a problem for typical enterprise use-cases, but a problem/inconvenience for your typical "private" user (which can be negated with support software).

Anyway I think I want to buy one.

Re: Yubico is merging with ACQ Bure and intends to go public

#76

Post by drexlspivey »

Sander_Marechal wrote: post #24
VMG wrote: post #9

Earlier quoted context omitted.

> A special purpose acquisition company (SPAC; /spæk/), also known as a "blank check company", is a shell corporation listed on a stock exchange with the purpose of acquiring a private company, thus making it public without going through the traditional initial public offering process and the associated regulations thereof. https://en.wikipedia.org/wiki/Special-purpose_acquisition_co...

Why is that even legal?

If “Hacker” News was assigned as a regulator nothing would be legal

Re: Yubico is merging with ACQ Bure and intends to go public

#77

Post by yellow_lead »

Raed667 wrote: post #21
pavlov wrote: post #14

Earlier quoted context omitted.

This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). It has no operations, it just holds a bunch of money put in by investors who want to find a private company that wants to go public.

The fact this is not only legal, but common practice baffles me ...

Although it's not illegal, I thought exchanges used to delist companies for this. At least NYSE. Maybe someone has more insight

Re: Yubico is merging with ACQ Bure and intends to go public

#78

Post by snorremd »

red_admiral wrote: post #70
snorremd wrote: post #26

I really hope this does not affect their current mode of operation. The reason I bought my Yubikeys in the first place were the one off purchase cost and the promise that the keys would do their job without me having to interact with Yubico from that point onwards. This has worked great so far! Now with shareholders in the mix I fear they will try to find recurring income models to increase profits. I guess we'll jus…

How would that model work considering the key is a piece of hardware, built to implement an open standard (at least for the U2F mode)? There's no "key phone home" phase in U2F. Also, though I would miss yubikeys if they went under like this, in practice I could switch to google titan or something else and it wouldn't be the end of the world.

The current keys will of course work as before. It is more that their new offerings might change this model all together by tying authentication of the key into some cloud service requiring non-standard drivers. Probably unfounded fears as this would make the keys less attractive to their user base.

Yes, there are competitors. But I really don't want to be reliant on Google as a company. I guess Solo Keys and Nitro Keys could be good alternatives, but I really feel Yubico has a great reputation as far as hardware token companies go.

Re: Yubico is merging with ACQ Bure and intends to go public

#79

Post by dathinab »

adql wrote: post #74
cinntaile wrote: post #6

Earlier quoted context omitted.

You could buy a programmable open source security key instead, they recently opened their shop. https://tillitis.se/ Some of the people behind Mullvad VPN are associated with it.

That site is fucking garbage, and there doesn't even see to be a dock on what it supports. Like, programmable key is cool as an idea but I need smartcard support and a button on it to confirm transaction to replace YK usage...

> and there doesn't even see to be a dock on what it supports.

there is, at the bottom of the get started page

currently besides validating the key itself only ssh and git signing by ssh key is supported by them

Also directly from the main page the first noticeable thing:

> TKey’s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky for end-users.

I.e. it's for now mainly for developers not end users (for now).

There is a "button" on it. (Which yes isn't mentioned anywhere, outside of some article you can navigate to by following multiple links).

Most important (and they could be more clear about it) it doesn't have (writable) persistent memory. Which has both some grate benefits and but can also have some major inconvenience. And depending on how/for what you use smartcard support I'm not sure it might ever support it.

Anyway the shop opened around 16 days ago so it's still very early days for TKeys (and their website, and documentation, etc.).

I'm looking forward to what it will enable.

But AFIK it's already a grate choice for certain kinds of companies for their employees.

Re: Yubico is merging with ACQ Bure and intends to go public

#80

Post by rootio »

xarope wrote: post #36
rootio wrote: post #15

Earlier quoted context omitted.

Like SoloKeys? The Solo 2 has a firmware written in Rust: https://solokeys.com

Anybody have a solokey, or have some feedback? I wanted to buy some, but the comments about bent connectors put me off, as well as the supply issues for usb-c

Solo 2 fixed the bent connectors issue. Solo 2 USB-C has supply issues, you'll probably have to wait a couple of months to get one.
Post reply on HN