Slashdot Mirror

← Back to Stories (view on slashdot.org)

Yubikey Neo Teardown and Durability Review

Posted by timothy on from the do-not-place-in-any-mailbox dept.

An anonymous reader writes: Folks at HexView (disclaimer: I contract for the company) took apart Yubikey Neo and found out that, while the key uses solid hardware to ensure secure identity management, its physical anti-tamper measures and durability could be improved. The tear-down analysis is short, but to the point, and offers some very nice close-ups of the internals. One example of the design shortcomings they've identified: Contrary to Yubico's claims, Yubikey appears to be quite destructable. Do not push on it when you touch the sensor while the key is plugged in to a USB port. The point where it bends the most happens to be the point where USB vias are located and through which NFC antenna loop goes. To make things worse, the injection molding hole right next to the connector makes this area even more susceptible to bending.

5 of 88 comments (clear)

  1. Okay, what is it? by TWX · · Score: 4, Insightful

    The branding, "Yubikey Neo," means nothing to me. Sounds like an Asian version of the main character from The Matrix.

    --
    Do not look into laser with remaining eye.
    1. Re:Okay, what is it? by OzPeter · · Score: 5, Insightful

      Try Google.

      I have one on my keyring. I know exactly what it is, and what it is used for.

      In other words you have prior information that makes sense out of the word salad that passes for summaries these days.

      The rest of use just look at the summary and go WTF?!?!?!?

      And yes, I have heard of that Google thing, but one of the prime tenets of good communication is to not make your audience go elsewhere for fundamental information. Because sooner or later they will be going to other sources for all of their information and will be by-passing you completely.

      --
      I am Slashdot. Are you Slashdot as well?
    2. Re:Okay, what is it? by antiperimetaparalogo · · Score: 4, Insightful

      Line 1 from The Fine Article linked in summary: "Yubikey Neo is a $50 authentication token (with bells and whistles) from Yubico."

      And the whole Slashdot summary: "An anonymous reader writes: Folks at HexView (disclaimer: I contract for the company) took apart Yubikey Neo and found out that, while the key uses solid hardware to ensure secure identity management, its physical anti-tamper measures and durability could be improved. The tear-down analysis is short, but to the point, and offers some very nice close-ups of the internals. One example of the design shortcomings they've identified: Contrary to Yubico's claims, Yubikey appears to be quite destructable. Do not push on it when you touch the sensor while the key is plugged in to a USB port. The point where it bends the most happens to be the point where USB vias are located and through which NFC antenna loop goes. To make things worse, the injection molding hole right next to the connector makes this area even more susceptible to bending."

      Now imagine the Slashdot summary with something like the "Line 1 from The Fine Article linked in summary" that explains what the linked article is about...

      --
      Antisthenes: "Wisdom begins by examining the words/names." - excuse my English, i am (slightly...) better with my Greek!
  2. And nothing of value was lost. by Hognoxious · · Score: 4, Insightful

    Wrong. On Slashdot we never read the article. We barely even scan the summary.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    1. Re:And nothing of value was lost. by Anonymous Coward · · Score: 2, Insightful

      Wrong.

      Incorrect. On Slashdot, we don't even fully read the comments. All I know is that I'm right, and you're attacking someone's opinion, maybe mine, maybe even yours, it doesn't matter. All that matters is that you said "wrong" and now we are arguing. You'll never change your mind, nor I mine. The readers though, and those rare but precious bestowers of mod points, those are the opinions to change.

      Were you or I part of a shill argument whereby two extreme views are argued while a third shill shifts the Hegelian dialectic via offering a more reasonable yet propaganda supporting middle ground, then I wouldn't even need to read your comment at all.

      That, my adversary, is Slashdot. It's not pretty, but it's the one I go home with, and so do you, because we all know that slut loves attention more than any one of us.