Hacker News Reader

That price point needs to come way down. Yubico thinks they're competing with established HSM vendors, but they're really competing with their own products. If I have a small business and am considering a hackish YubiKey-as-HSM for $40, it may be worth it to spend around $100 on an officially supported YubiHSM instead.

View on HN

If $650 is a lot for your business, wouldn’t you just keep the keys on disk? Hardware-based security implies that you have a compliance regime to satisfy, or at least something valuable to protect.

Agreed. For even a small tech business, $650 should be in the 'lol whatever' category of purchasing - especially if there's compliance regimes mandating some kind of HSM in the stack.

However, this device lacks FIPS 140-2 certification of any type, which is a huge detractor for any company wanting to shovel that kind of money towards a solution.

I checked the "NIST List" (rhymes haha), and they might have this module under evaluation:

https://csrc.nist.gov/Projects/Cryptographic-Module-Validati...

FIPS certified HSMs cost 10-100x what the YubiHSM does.

Why aren't they competing with established vendors?

Reply on news.ycombinator.com