Hacker News Reader

Comment by supermatou | Hacker News Reader

Anyone else using a similar product, OTHER than Yubikey? I've read on certain forums about Yubikeys being "flimsy" and less durable than similar products; is this true? what is your experience with it?

View on HN

I have a less durable, cheaper U2F key, which is sort of the opposite of what you were asking for. I actually don't know of anything that's more durable... the yubikeys that fit inside a USB A port are pretty damn durable.

I have four Yubikeys (three of the "4" variant, one of the nano) and all of them are extremely durable. You'd have to purposefully try to damage one for anything to happen to it.

I've had mine for close to a year now, and for a while it was on my keychain daily. It has held up well!

Yubikeys actually seem pretty durable; that seems to be the gist of the opinions I've read on their durability. A piece of anecdotal evidence; I am carrying an older model Yubikey on my keyring, and it is holding up pretty well (almost two years now).

They certainly don't come across as flimsy.

I have had a yubikey neo on my keychain for almost 4 years now. It is thin plastic and seemed like it might not hold up this long, but it has been going strong. I think they have changed designs to make it smaller since (which would be stronger). They do make solid products.

That said, I would rather use Google Authenticate (TOTP) for two factor. Getting my phone out is a regular thing. Getting the yubikey out and plugging it in seems more of a hassle. Passpack is the only thing I have to use the yubikey for -- would be happy if they provided TOTP. Spending $40 for two factor these days is kind of ridiculous.

Why not just leave it plugged in. That might be tricky in a train or so, but normally its fine. I use a Nano and just leave it in most of the time.

Its not only more convinient, its also far, far safer then TOTP.

The will not support TOPT because that would require constant power.

You can get a U2F only stick for 18 bucks from them. Once in a while (for example when github interduced U2F the sell 2 for 5$).

Yubikeys support TOTP...

https://www.yubico.com/support/knowledge-base/categories/art...

TOTP requires an app, Yubico Authenticator.

Exactly, and if you are going to use an app anyway, you may as well have the app keep the token.

I actually still use it because this was I can use somebody else phone or some other device if I need to. That has come in very handy before.

I regularly use 8 different devices (laptops and desktops). That's USD$400 in keys if I were to keep them in devices, not including shipping, currency conversion, etc.

Then there's the concern about who has access to those keys when I'm not around.

I keep a backup key in a safe location, and my primary on my keychain which is typically in my pocket.

I've worn out multiple USB extension cables with my Yubikey, but the device itself is still going strong.

I have a Nitrokey Pro in addition to my YubiKey 4. I love that it's got a much more open design and am happy to support the company for that reason, but its enclosure looks like a reasonably good generic USB key. Going only by tactile feel, I expect the Yubikey to outlast it.

I've had a YubiKey on my keychain for over a year and a half and it's held up very well. It looks quite beat up due to being in my pocket, rubbing on other keys, and so on but it works perfectly.

I have a regular Yubikey 4 - it looks like flimsy plastic but it's surprisingly strong. I can't snap it in half even with full force, doesn't even seem to bend.

Reply on news.ycombinator.com