Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico is merging with ACQ Bure and intends to go public

yubico.com

Post reply on HN
Print view View original

81–90 of 222 posts

Re: Yubico is merging with ACQ Bure and intends to go public

#81

Post by woodruffw »

no_time wrote: post #63
woodruffw wrote: post #31

Earlier quoted context omitted.

WebAuthn doesn’t require the RP to enforce any particular hardware attestation, and many sites (the overwhelmingly majority?) allow anonymous attestation, self-attestation, or simply no attestation at all. Having hard-to-extract device keys isn’t “DIY hostile”; it’s critical to the attestation security model. If you want to build your own WebAuthn authenticator, then you can either form your attestation root (there’s…

I am aware how attestation works and what problem it addresses. But I strongly believe the power imbalance it creates outweighs the benefits. Especially with bullshit like CF using it as a captcha substitute. https://blog.cloudflare.com/introducing-cryptographic-attest...

I happen to agree that this is a bad use of attestation (as well as a pointless one, since it’s cheaper and easier for a click farm to do attestation with a bunch of yubikeys than to contact out CAPTCHA solves).

However, I don’t really think it’s an indictment of either WebAuthn or attestation more generally: as pointed out, most public services do not (and probably will never) require attestation. The winds are against it more generally: non-attestation flows are easier to implement, and WebAuthn adoption is increasingly driven by authenticators that don’t necessarily offer useful attestations (e.g. on-device and virtual tokens). Most future users of WebAuthn won’t have physical keys of the sort that Cloudflare’s scheme will require.

Re: Yubico is merging with ACQ Bure and intends to go public

#82

Post by fnordpiglet »

bhawks wrote: post #38
Raed667 wrote: post #21

Earlier quoted context omitted.

The fact this is not only legal, but common practice baffles me ...

It's faster and cheaper, those are things that are generally considered valuable. Faster: the finance markets have been extremely tenuous the past 4 years between pandemics, supply chain crisis, world wars, inflation, and so on. An IPO requires 12 to 18 months of work / process before listing. SPACs can be done in a quarter or 2. In uncertain times it is much less risky to get the listing done fast. Cheaper: Startups…

“Faster and cheaper” isn’t really the goal when selling stock to retirees and pension funds. Going public is supposed to be a rigorous process of assuring your grandparents that this company meets a minimum bar of compliance and financial quality. Finding a back door to avoid scrutiny is a flaw, not a feature. I get that we all want to avoid the paperwork and red tape in life, but there are certain things that we have seen burn too many people too many times that we as a society demand you slow down and dot your i’s and cross your t’s for very good reasons.

Re: Yubico is merging with ACQ Bure and intends to go public

#83

Post by lordnacho »

bhawks wrote: post #38
Raed667 wrote: post #21

Earlier quoted context omitted.

The fact this is not only legal, but common practice baffles me ...

It's faster and cheaper, those are things that are generally considered valuable. Faster: the finance markets have been extremely tenuous the past 4 years between pandemics, supply chain crisis, world wars, inflation, and so on. An IPO requires 12 to 18 months of work / process before listing. SPACs can be done in a quarter or 2. In uncertain times it is much less risky to get the listing done fast. Cheaper: Startups…

I don't think you can avoid the conclusion that this is a legal loophole. It's "easy" to get listed as an empty shell because there's nothing there to check. Then you buy an actual business and everything is just dandy? Seems fishy to me.

Re: Yubico is merging with ACQ Bure and intends to go public

#84

Post by flandish »

belter wrote: post #56
snorremd wrote: post #26

I really hope this does not affect their current mode of operation. The reason I bought my Yubikeys in the first place were the one off purchase cost and the promise that the keys would do their job without me having to interact with Yubico from that point onwards. This has worked great so far! Now with shareholders in the mix I fear they will try to find recurring income models to increase profits. I guess we'll jus…

As somebody who just bought some keys last week for the same exact reasons, I share the same exact concerns. Why this need to always make more and more money? Do one thing, do it right, keep your customers happy, get your money, enjoy your life...

This “why” is the ever expanding nature of capitalism.

Re: Yubico is merging with ACQ Bure and intends to go public

#85

Post by bberrry »

JoachimS wrote: post #27
bberrry wrote: post #5

Earlier quoted context omitted.

Very. They are a tiny Swedish company that pay for top talent, are quite active and hands-on in the netsec community. It's not a faceless corporation with a Chinese PO Box.

Tiny is a bit misleading. The turnover is about 100 MUSD. The company has about 300 employees, with offices in all regions of the world and a lot of R&D in the USA.

I wasn't aware they had grown that much. Thanks for the correction

Re: Yubico is merging with ACQ Bure and intends to go public

#86

Post by lotsofpulp »

gizmo wrote: post #45
bhawks wrote: post #38

Earlier quoted context omitted.

It's faster and cheaper, those are things that are generally considered valuable. Faster: the finance markets have been extremely tenuous the past 4 years between pandemics, supply chain crisis, world wars, inflation, and so on. An IPO requires 12 to 18 months of work / process before listing. SPACs can be done in a quarter or 2. In uncertain times it is much less risky to get the listing done fast. Cheaper: Startups…

We’ve seen pre-revenue companies that promised flying cars and other obvious scams go public via SPACs. If you don’t consider that SPAC abuse your bar is a lot lower than mine. These are companies that had no chance of surviving the more serious road show due diligence that the likes of GS demand when they take startups public. Instead we saw popular podcasts push their SPACs on gullible retail investors, based on fu…

Index ETFs have been around for 15+ years now, and the advice is widely known that if you are an uneducated investor without inside information or some type of edge, you should stick to sub 0.15% expense ratio index funds. It is so easy nowadays that all you have to do is figure out the year you want to retire and buy that year’s target date fund and forget about it.

If people want to gamble, then that is their problem.

Re: Yubico is merging with ACQ Bure and intends to go public

#87

Post by lotsofpulp »

belter wrote: post #56
snorremd wrote: post #26

I really hope this does not affect their current mode of operation. The reason I bought my Yubikeys in the first place were the one off purchase cost and the promise that the keys would do their job without me having to interact with Yubico from that point onwards. This has worked great so far! Now with shareholders in the mix I fear they will try to find recurring income models to increase profits. I guess we'll jus…

As somebody who just bought some keys last week for the same exact reasons, I share the same exact concerns. Why this need to always make more and more money? Do one thing, do it right, keep your customers happy, get your money, enjoy your life...

Do you expect your retirement savings to earn a minimum of x% per year? What is that x%?

Re: Yubico is merging with ACQ Bure and intends to go public

#88

Post by belter »

lotsofpulp wrote: post #87
belter wrote: post #56

Earlier quoted context omitted.

As somebody who just bought some keys last week for the same exact reasons, I share the same exact concerns. Why this need to always make more and more money? Do one thing, do it right, keep your customers happy, get your money, enjoy your life...

Do you expect your retirement savings to earn a minimum of x% per year? What is that x%?

I expect a company to turn and stay profitable, by doing their core business, prioritizing product quality, customer service and sustainable development. Not to end up as an over leveraged financial construct riding on extracting more and more of their customers. Optimize the business quality not the shareholders returns.

Re: Yubico is merging with ACQ Bure and intends to go public

#89

Post by tonyarkles »

account-5 wrote: post #64

Seems like another reason not to use yubikeys, especially with the push for Fido. The cynical part of me assumes going public means they'll need to generate more income for investors. Fancy a subscription service to keep you yubikeys working?

So maybe I’m too much of an optimist but I’be been thinking about Tailscale a lot recently because of how much of a game changer their product has been for us. I shudder to imagine what our VPN setup would look like at work if I hadn’t discovered Tailscale a month or two before the COVID craziness all started.

Maybe Yubikey could do to PKI what Tailscale did for VPNs: make the whole process dramatically simpler and easy to use. Still sell Yubikeys, please, but set up a funnel to capture corporate recurring revenue by solving this problem better than the alternatives.

Re: Yubico is merging with ACQ Bure and intends to go public

#90

Post by belter »

JoachimS wrote: post #54
FeistySkink wrote: post #53

Earlier quoted context omitted.

Is the TKey tamper-proof?

No, not yet. Physical attacks are out of scope for the TKey1, even if we have some mechanisms in play which try to extend the time and effort required to perform a successful evil maid-attack extracting the Unique Device Secret (UDS). See the threat model for the release: https://github.com/tillitis/tillitis-key1/blob/main/doc/thre... The current casing is fairly tamper evident (it will break), but we do not yet use…

When you do, please think about a special price for existing customers ;-)
Post reply on HN