Designing and Producing 2FA tokens to Sell on Amazon (opens in new tab)

Here's an option. There are companies in China which sell standard enclosures for USB plug-in devices. They'll even throw in a color of your choice and a sticker. You'd have to redesign your board to fit their case, but that may be a lot easier than dealing with encapsulation.[1]

[1] https://www.aliexpress.com/item/1-pcs-szomk-white-small-usb-...

You may be able to use one of these

http://www.digikey.com/product-detail/en/bud-industries/USB-...

it looks rather cute! see: https://blog.adafruit.com/2011/03/04/part-finder-friday-clea...

board respin required...either position the button so you squeeze the enclosure to press the button (it flexes a bit), or drill a small hole (use a jig to get the drill bit in the right location

enclosure co's will also customize/drill holes for you but its probably easier for you to just diy!

Good idea, but I see ads in that sector saying "Molds start at $4990".

I've seen people do things like this at TechShop. They carve a positive mold out of maybe a dense wood. Then use that to make an negative mold out of some pourable plastic like RTV. Then insert the device, pour in epoxy, and wait for it to cure. The negative molds wear out fast, but you can make more from the positives. There are lots of plastic options and books on this stuff. People use these processes to turn out stuff to sell on Etsy. All this is do-able, but usually messy.

Still, struggling through the process to have an MVP to show resellers is worth the trouble. If you get a big order, you can go out to Cavist or someone like them and have them produce in volume.

One super cheap idea that might be worth considering: clear shrink tubing. You could put whole trays of them at a time in your oven, just make sure the tubing is the right length and lined up right.

You might even be able to get away with not cutting out a hole for the button, as it could be activated through the flexible tubing.

You may want to consider something like this, even though maybe it would take too much time, it would look awesome.

http://runawaybrainz.blogspot.co.uk/2012/04/audio-crystal-cm...

Look for someone who's already encapsulated USB devices. They might be able to reuse an existing mold. That business is all tooling cost; per-unit cost is tiny.

But don't send the job to China, or your device will be copied, cheaper.

Honestly I think you're fine right now. Think of this initial run as a market test. If you end up selling out your entire stock, tell friends and family that you need a small loan and work with someone domestic to get your enclosure done.

Polycase might be a good place to start once you sell out. They sell generic cases and will quote you on modifications to their existing USB case.

After that (if you continue to sell out), you're probably a real business. Keep the domestic machine running and hop over to China to explore driving costs down. Probably explore what type of software/service might complement your hardware to drive recurring revenue. Create custom single unit packaging and bulk delivery packaging for consumer selling and business selling.

+1 on the case being a must have. I'll put some shrink tube over the ones I just ordered to keep them from getting banged up. Looking forward to trying it out in a few days.

It's serious, but there's the possibility that Plasti-Dip might get into the interior of the button and insulate it so it doesn't work. You need sealed buttons. Some surface-mount buttons are sealed.[1] Many are not. I was thinking more from the point of view of what simple manufacturing step could the maker add to package the thing. Shrink-tube sounds good, although it might hold the button down if shrunk too hard.

[1] https://www.omron.com/ecb/products/sw/24/b3s.html

Use a potting mold with a tube sticking through it and down to the button, and a button with a long plunger.

I'd price that up before suggesting it.

Better smartphone auth setups doesn't require typing in the code. Like Duo Push.

OK, the token security outweighs the usability.

Of course, I don't deny there're security benefits, but IMHO it's worth mentioning that there're some trade-offs.

>Well, of course there are always tradeoffs. The biggest one right now is that Google Chrome is the only major browser that supports U2F.

>Because it requires browser support to act as an intermediary between the website and the security key, you can only use it if the browser supports it.

>Mobile is also an issue, as they don't have USB ports!

>Some YubiKeys support U2F via wireless NFC, but support for this in mobile phones is very limited at the moment.

Ummm... can you please include an explanation on your website that makes sense to non-developers who haven't heard of either Yubico or U2F before?

"It's the same as any other U2F token" is meaningless to a rather significant proportion of humanity.

That's not correct. A U2F device cryptographically signs signed challenges with a key that never leaves the device. (Yes, it signs a signed challenge. That's not a typo.) The issuer of the challenge verifies both signatures to confirm that the user possesses the device and that the issuer genuinely issued the challenge embedded in the signed response.

Unlike the OTP token you're describing, a U2F device is effectively stateless. And unlike an OTP token, its signing mechanism is resistant to phishing. Finally, a U2F device is not a HID keyboard, contrary to your other comment on this page. But it is a HID-compliant device.

I think you're being very sensible about this. As the parent poster says, you need to have a distinguishing feature if you want to turn this into a product to compete with e.g. Yubikey. But as a resume/CV for getting you a job? It's fantastic. Bring it to interviews. Show it to people at trade shows. Get an embedded systems or electronics job. Profit.

Great work, Connor. I have spent considerable time thinking about the federal student loan forgiveness you're referring to. I'd love to share. Email me at mike at medcrypt dot co if you're interested.

Think of it as an Arduino for security. I can be programmed to act like a U2F token, a bitcoin wallet, secure storage for ssh keys, etc. A future version will have a second USB port so it can turn a regular USB thumb drive into an encrypted drive, act as a "USB condom" between your computer and a suspect USB device, or turn a regular keyboard into a smart keyboard that can generate and play back secure passwords. Because it has local I/O (a display and two buttons) it can do all of these things while remaining secure against an adversary that pwns the machine it is plugged in to. And because it uses stock hardware and is user-programmable you can be fairly confident that it doesn't have any back doors built in to it.

Of course, it doens't actually do most of those things yet (working on getting the bugs out of the U2F code right now) which is why right now it's just a toy for hackers and devs. But the apps are coming.

Generally U2F widgets don't run code or have any extra functionality unless they specifically mention it.

The OP key looks pretty barebones I wouldn't expect it to generate/store/use ssh or pgp private keys. That's more like a yubi key 4 or similar more expensive widgets that are basically smartcards and/or HSMs.

There is a U2F pam module that can allow you to use a U2F widget for screen unlock, login, sudo and the like. If you are worried about the U2F dying/being stolen/lost then you could always authorize more than one U2F widget and keep one in a safe place.

Well by "do login" I meant to basically require that + password. It's good to see it's possible.

I've been toying with the idea of buying a dock for my thinkpad and using it as my main system retiring my current low-powered desktop as a server.

My main concern is that, since I keep important docs on my system, I'd now be carrying them with me. Doing 2FA for harddrive decryption and system login would be amazing for me since then I'd be able to know that even if my computer is stolen the "attacker" won't really have the means to login.

Thanks. I have quite a few services that only let me register one key. I always worry that if I lose my phone (or break it) I am going to be locked out.

I'm naive and didn't realize Amazon wouldn't ship internationally by default. I just updated the listing to enable international shipping which should take effect in a couple days. Thanks!

Ah, thanks for the info!

It's not too hard if you have a proper PCB with solder resist. The surface tension of the solder causes it too glob onto your part's pins and the pads below them. The solder resist is really key here, or else it's essentially impossible.

You will have to test for solder bridges between pins, and maybe use some solder wick to get any excess out.

It's not super fast, but it's absolutely doable with an hour or two of practice. Solder paste and a heat gun is the next step up, which I find more difficult to get right (I'm bad at applying the paste).

Right, maybe it's location based but from my account I see Prime (2 days) for the linked product, and Prime (5 days) for the zero

A better comparison is the Yubico Fido U2F key, which just does U2F. https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

Yeah I'm not sure about the legals and just figured it would be fine. I did get a VID/PID from SiLabs which has already done USB certification for the chip.

FIDO U2F also has a $10k certification process to allow you to use the FIDO logo. I don't think it's worth pursuing for me.