Hacker News Reader

If $650 is a lot for your business, wouldn’t you just keep the keys on disk? Hardware-based security implies that you have a compliance regime to satisfy, or at least something valuable to protect.

View on HN

Agreed. For even a small tech business, $650 should be in the 'lol whatever' category of purchasing - especially if there's compliance regimes mandating some kind of HSM in the stack.

However, this device lacks FIPS 140-2 certification of any type, which is a huge detractor for any company wanting to shovel that kind of money towards a solution.

I checked the "NIST List" (rhymes haha), and they might have this module under evaluation:

https://csrc.nist.gov/Projects/Cryptographic-Module-Validati...

FIPS certified HSMs cost 10-100x what the YubiHSM does.

Reply on news.ycombinator.com