Hacker News Reader

Comment by tptacek | Hacker News Reader

What processor parts will this be using?

A major benefit of the Yubikey U2F parts is that they're almost indestructible. I've heard over and over again about how flimsy the Feitian parts are, and from people who have run over their Yubikeys with cars and still had them work. How resilient (in particular: waterproof) will these be?

View on HN

The one in the pictures uses a EFM32 Jade/Pearl [1]. More details are in the discussion on github: [2].

[1] https://www.silabs.com/products/mcu/32-bit/efm32-pearl-gecko

[2] https://github.com/conorpp/u2f-zero/issues/76

That's a better MCU, but aren't they using a secure element to store keys?

Right. Why not add a ATECC608A?

ATECC608A is nice but can't provide total key isolation with the key derivation method most U2F keys use. E.g. it calculates the key using an HMAC, it gets sent back to MCU, the MCU writes it as a private key back to the ATECC608A to be used for signature. Also the ATECC608A requires an NDA.

Given this, I think having a 1 chip solution really simplifies the design and allows more flexibility.

Of two U2F yubikeys I own, one of them has stopped working when touching it, in less than 2 years. I don't know about other companies, but my personal experience is that they are not that long lasting.

(I have them alongside my keys; one is a NEO - still working - the other is (was) U2F only)

My NEO has been on my keyring for several years. Still going strong.

My Yubikey Neo has been on my keyring for over three years, too. No problems at all. They seem pretty rugged.

I've found that washing the Yubikeys, especially if they are on a keychain, can be helpful. Soap and water, and then let it dry thoroughly before using it again. The theory here is that build up on the contacts make them not able to conduct as well, and so touches aren't detected. It worked for, YMMV.

I accidentally bricked one when I walked across a carpeted room and zapped it with a static charge.

Having been a part of a few large Yubikey rollouts I can say while the individual/SMB perspective is that they are "indestructible", large fleets see hardware failure rates above what you would expect from similar types of devices.

I don't setup hardware 2FA on personal accounts with less than 3 enrolled devices (and from 2 different vendors).

We are using a EFM32 Silabs chipset and plan to use some sort of conformal coating to add water/weather resistance. We also plan to have a silicone case. I don't know about getting run over by a car, but they will certainly be resilient to dropping, getting wet, surviving key-chains.

Yubikey 4C is very fragile. Mine has quite severe cracks on its plastic casing after 4 months of casual use (nothing extreme!), and I expect it to break in some months.

YK4 (non-C) is quite robust, though.

My experience has been the same, I've had a 4 for years and it is still going strong but my 4C died in less than 12 months; the USB-C connector is too flimsy.

The connector itself is okay; it's just that the casing is poor. When it finally breaks apart, I'm going to try to cast the board in epoxy. Either I'll succeed, and it will be (hopefully) durable, or I'll completely ruin it - but it'll be broken by that time anyway.

Maybe a 3D printed mold so one could pot the thing in urethane?

Reply on news.ycombinator.com