4 ms·

If you bought your Yubikey on Amazon, you can't replace it directly, but have to contact the seller. As Amazon tends to intermingle supply from different resel

If you bought your Yubikey on Amazon, you can't replace it directly, but have to contact the seller. As Amazon tends to intermingle supply from different resellers for Fulfillment by Amazon products, you might have a Yubikey whose Serial No is registered to a different reseller than the one you paid - as result, replacement is going to be complicated. EDIT: Here the message the Yubico website displays: https://i.imgur.com/FVINcQB.jpg https://i.imgur.com/FVINcQB.jpg, and the response from the support: https://i.imgur.com/it8zxgp.png https://i.imgur.com/it8zxgp.png Now I'm left with a Yubikey that's produces broken RSA keys, and Yubico refuses to take responsibility.

pfg 9y ago
That's weird. I bought two YubiKeys on amazon.co.uk about 1.5 years ago and was able to use the replacement form on Yubico's site (the one that asks for three OTPs) to order replacements directly from them.
- kuschku 9y ago
  I bought mine on Amazon.de on 2017-03-02, and it was apparently sold by MTRIX GmbH. The replacement form tells me "Please contact the team or individual within your organization that issued your current YubiKey." Yubico told me: > Thank you for contacting Yubico Support. That was bought through MTRIX GmbH, one of our resellers. They are responsible for replacement of all devices bought through them as part of the reseller agreement. You will need to contact them for the replacement process.
jlgaddis 9y ago
OTOH, I bought at least one of my affected ones via Amazon and had zero problems with a replacement.
- deleted 9y ago
  [deleted]
- OJFord 9y ago
  It seemed to accept my request (didn't error on entering the serial - but I uploaded a picture instead of giving OTPs) - perhaps because it was sold by Yubico; fulfilled by Amazon.
  - kuschku 9y ago
    The problem with Fulfilled by Amazon is that while you think you buy directly from Yubico, you might end up with a device from a reseller. Who actually ships your device is entirely random. That's what happened to me, and it's infuriating.
    - acdha 9y ago
      It says on the page and order form who you’re buying from. The problem is that reseller agreement not being public — normally the products are the same across sellers but in this case there’s a big difference in what you’re getting.
      - deleted 9y ago
        [deleted]
      - kuschku 9y ago
        That information isn't always accurate, but that's not even that relevant here. It's not made clear at all how you have to handle RMA in such cases, and customers end up confused. I'd never have bought a Yubikey this way if I had known about the RMA and replacement procedure beforehand.
        jopsen 9y ago
        Lesson being buy directly from yubicon. It kind of makes sense to have as few trust points involved as possible when buying a security device like this. One could argue yubicon should only sell directly, but that would probably hurt business.
        9y ago
tptacek 9y ago
The Yubikey refund site just asks you to prove you own a Y4 by generating OTP inputs and then gives you a coupon code to buy directly from Yubico's site.
- kuschku 9y ago
  It doesn't if you bought via Amazon. I tried the page. It just shows an error and displays: > Please contact the team or individual within your organization that issued your current YubiKey. I contacted Yubico support, and they said this is expected, and I'll have to contact the reseller that sold the key on Amazon. To quote: > Thank you for contacting Yubico Support. That was bought through MTRIX GmbH, one of our resellers. They are responsible for replacement of all devices bought through them as part of the reseller agreement. You will need to contact them for the replacement process.
  - tptacek 9y ago
    This is fucked up (and not the only part of Yubico's process I'm not OK with). They manufactured and sold security tokens that generate factorable RSA keys. They shouldn't be fucking around.
    - kuschku 9y ago
      Here's the exact message, and my Yubikey: https://i.imgur.com/FVINcQB.jpg https://i.imgur.com/FVINcQB.jpg and the response from support: https://i.imgur.com/it8zxgp.png https://i.imgur.com/it8zxgp.png Now I'm stuck with a Yubikey that's insecure, and replacement will take ages to get through.
  - retox 9y ago
    Can someone explain why it should matter where you bought the product when there is only one manufacturer? Can't understand it at all.
  - tehno 9y ago
    I bought mine via Amazon.co.uk but fortunately my order was fulfilled by Yubico itself it seems [1]. So my key was eligible for the coupon and I got full $40 off and free shipping from Yubico store just a moment ago. [1] https://www.amazon.co.uk/s?merchant=A2Z7AQ6XNQ4XXH&fallThrough=1 https://www.amazon.co.uk/s?merchant=A2Z7AQ6XNQ4XXH&fallThrou...
kuschku 9y ago
Edit: Yubico has just responded again, and now also offers replacements for keys bought through resellers, with their sincerest apologies. The issue should be solved now. Update: managed to get a replacement for mine.

pfg 9y ago

That's weird. I bought two YubiKeys on amazon.co.uk about 1.5 years ago and was able to use the replacement form on Yubico's site (the one that asks for three OTPs) to order replacements directly from them.

kuschku 9y ago
I bought mine on Amazon.de on 2017-03-02, and it was apparently sold by MTRIX GmbH. The replacement form tells me "Please contact the team or individual within your organization that issued your current YubiKey." Yubico told me: > Thank you for contacting Yubico Support. That was bought through MTRIX GmbH, one of our resellers. They are responsible for replacement of all devices bought through them as part of the reseller agreement. You will need to contact them for the replacement process.

jlgaddis 9y ago

OTOH, I bought at least one of my affected ones via Amazon and had zero problems with a replacement.

deleted 9y ago
[deleted]
OJFord 9y ago
It seemed to accept my request (didn't error on entering the serial - but I uploaded a picture instead of giving OTPs) - perhaps because it was sold by Yubico; fulfilled by Amazon.
- kuschku 9y ago
  The problem with Fulfilled by Amazon is that while you think you buy directly from Yubico, you might end up with a device from a reseller. Who actually ships your device is entirely random. That's what happened to me, and it's infuriating.
  - acdha 9y ago
    It says on the page and order form who you’re buying from. The problem is that reseller agreement not being public — normally the products are the same across sellers but in this case there’s a big difference in what you’re getting.
    - deleted 9y ago
      [deleted]
    - kuschku 9y ago
      That information isn't always accurate, but that's not even that relevant here. It's not made clear at all how you have to handle RMA in such cases, and customers end up confused. I'd never have bought a Yubikey this way if I had known about the RMA and replacement procedure beforehand.
      - jopsen 9y ago
        Lesson being buy directly from yubicon. It kind of makes sense to have as few trust points involved as possible when buying a security device like this. One could argue yubicon should only sell directly, but that would probably hurt business.
        9y ago

tptacek 9y ago

The Yubikey refund site just asks you to prove you own a Y4 by generating OTP inputs and then gives you a coupon code to buy directly from Yubico's site.

kuschku 9y ago
It doesn't if you bought via Amazon. I tried the page. It just shows an error and displays: > Please contact the team or individual within your organization that issued your current YubiKey. I contacted Yubico support, and they said this is expected, and I'll have to contact the reseller that sold the key on Amazon. To quote: > Thank you for contacting Yubico Support. That was bought through MTRIX GmbH, one of our resellers. They are responsible for replacement of all devices bought through them as part of the reseller agreement. You will need to contact them for the replacement process.
- tptacek 9y ago
  This is fucked up (and not the only part of Yubico's process I'm not OK with). They manufactured and sold security tokens that generate factorable RSA keys. They shouldn't be fucking around.
  - kuschku 9y ago
    Here's the exact message, and my Yubikey: https://i.imgur.com/FVINcQB.jpg https://i.imgur.com/FVINcQB.jpg and the response from support: https://i.imgur.com/it8zxgp.png https://i.imgur.com/it8zxgp.png Now I'm stuck with a Yubikey that's insecure, and replacement will take ages to get through.
- retox 9y ago
  Can someone explain why it should matter where you bought the product when there is only one manufacturer? Can't understand it at all.
- tehno 9y ago
  I bought mine via Amazon.co.uk but fortunately my order was fulfilled by Yubico itself it seems [1]. So my key was eligible for the coupon and I got full $40 off and free shipping from Yubico store just a moment ago. [1] https://www.amazon.co.uk/s?merchant=A2Z7AQ6XNQ4XXH&fallThrough=1 https://www.amazon.co.uk/s?merchant=A2Z7AQ6XNQ4XXH&fallThrou...

kuschku 9y ago

Edit: Yubico has just responded again, and now also offers replacements for keys bought through resellers, with their sincerest apologies. The issue should be solved now. Update: managed to get a replacement for mine.