3 ms·

$50 seems very expensive. The actual hardware probably does not cost more than $10 and I can't see adoption of FIDO keys becoming widespread unless companies ar

by spuz 8y ago

$50 seems very expensive. The actual hardware probably does not cost more than $10 and I can't see adoption of FIDO keys becoming widespread unless companies are willing to sell keys at or below cost.

16bytes 8y ago
Yubikeys are about the same cost: https://www.yubico.com/product/yubikey-4-series/ https://www.yubico.com/product/yubikey-4-series/ What makes you think that the cost to produce the hardware is less than $10? And what reason would companies have to offer keys below cost?
- MikeKusold 8y ago
  The Yubikey 4 also provide more functionality such as PGP. This is more like the Yubikey Security Key ($20): https://www.yubico.com/product/security-key-by-yubico/#security-key https://www.yubico.com/product/security-key-by-yubico/#secur...
- spuz 8y ago
  If a bluetooth locator tag is only about £3.34 [1], then a tag with an encryption chip should not be 10x the cost. Google has an incentive for their keys to become widespread and well adopted because people will associate their brand with "high security". It also actually helps Google if they don't have to deal with support requests from users who've had their accounts compromised. [1]http://amzn.eu/d/bMowBkS http://amzn.eu/d/bMowBkS
- michaelt 8y ago
  The open-source U2F Zero claims ~$3 of parts and a ~$2 PCB [1] ordering a single unit. Making a large volume, that price is only going to come down. Admittedly you'd have to pay for a plastic case, assembly costs, an envelope and stamps. But if I can get a 16GB flash drive for $8 with free shipping [2] the plastic case, assembly etc can't be that expensive! [1] https://github.com/conorpp/u2f-zero https://github.com/conorpp/u2f-zero [2] https://www.amazon.com/SanDisk-Cruzer-Low-Profile-Drive-SDCZ33-016G-B35/dp/B005FYNSZA/ https://www.amazon.com/SanDisk-Cruzer-Low-Profile-Drive-SDCZ...
  - watersb 8y ago
    Bulk procurement, certification, software all affect cost, of course. When a flaw was discovered in 4096-bit RSA ley generation, Yubico sent me replacements for all of my registered hardware tokens, no additional cost to me. Good thing about a standard like U2F is reducing software and certification costs, and sure if you are clear to offer no post-sales support, then you should be able to get legitimate hardware for maybe $10.
    - michaelt 8y ago
      Oh, absolutely! I was responding to the statement "The actual hardware probably does not cost more than $10" which refers to the hardware specifically. The retail price would be higher than the hardware costs to cover software, support costs, returns, profit, shipping, credit card fees, and so on.
sowbug 8y ago
You are a web developer. Do you place any value on the cost of developing software?
- spuz 8y ago
  Yes of course, but the reason I mentioned the hardware cost is because that scales linearly with demand and software cost does not. The market for these kind of security devices is tiny right now but has the potential to be huge in the future. It would make sense for Google to sell their hardware at the lowest price they can in order to get people on board, after which network effects will ensure people stick with Google's services.
jiveturkey 8y ago
the secure element alone is $5 at million quantity
- michaelt 8y ago
  Do you think the chips they put inside smart cards and SIM cards cost that much?
- spuz 8y ago
  That's a lot! Where did you get that information?
kilo_bravo_3 8y ago
When selling hardware, unless you are extraordinarily dominant in a very large and highly competitive market (television manufacturing), care only about marketshare (lower-tier smartphone manufacturers), or have another revenue stream (game console sellers) generally speaking you should target 3x BOM as your final retail price at an absolute minimum. That's just for hunks of plastic. For complex (not a hunk of injected-molded plastic) devices with high non-BOM costs, you should be targeting 4x-5x at a minimum. Also, the 3x-5x rule is for bare-bones lean operations. If you actually want to make money, compensate your employees well, practice good environmental stewardship in the construction of your products, use a manufacturer that treats its employees with respect, and have a healthy business where you are prepared to weather future changes in the market, your BOM costs should be LESS THAN 20% of the MSRP. The model is also different if you are a Shenzhen ripoff factory dumping goods onto the market through Marketplace Sellers or Drop-Shippers. But that is not a model compatible with long-term prosperity or worker satisfaction.

by spuz 8y ago

16bytes 8y ago

Yubikeys are about the same cost: https://www.yubico.com/product/yubikey-4-series/ https://www.yubico.com/product/yubikey-4-series/ What makes you think that the cost to produce the hardware is less than $10? And what reason would companies have to offer keys below cost?

MikeKusold 8y ago
The Yubikey 4 also provide more functionality such as PGP. This is more like the Yubikey Security Key ($20): https://www.yubico.com/product/security-key-by-yubico/#security-key https://www.yubico.com/product/security-key-by-yubico/#secur...
spuz 8y ago
If a bluetooth locator tag is only about £3.34 [1], then a tag with an encryption chip should not be 10x the cost. Google has an incentive for their keys to become widespread and well adopted because people will associate their brand with "high security". It also actually helps Google if they don't have to deal with support requests from users who've had their accounts compromised. [1]http://amzn.eu/d/bMowBkS http://amzn.eu/d/bMowBkS
michaelt 8y ago
The open-source U2F Zero claims ~$3 of parts and a ~$2 PCB [1] ordering a single unit. Making a large volume, that price is only going to come down. Admittedly you'd have to pay for a plastic case, assembly costs, an envelope and stamps. But if I can get a 16GB flash drive for $8 with free shipping [2] the plastic case, assembly etc can't be that expensive! [1] https://github.com/conorpp/u2f-zero https://github.com/conorpp/u2f-zero [2] https://www.amazon.com/SanDisk-Cruzer-Low-Profile-Drive-SDCZ33-016G-B35/dp/B005FYNSZA/ https://www.amazon.com/SanDisk-Cruzer-Low-Profile-Drive-SDCZ...
- watersb 8y ago
  Bulk procurement, certification, software all affect cost, of course. When a flaw was discovered in 4096-bit RSA ley generation, Yubico sent me replacements for all of my registered hardware tokens, no additional cost to me. Good thing about a standard like U2F is reducing software and certification costs, and sure if you are clear to offer no post-sales support, then you should be able to get legitimate hardware for maybe $10.
  - michaelt 8y ago
    Oh, absolutely! I was responding to the statement "The actual hardware probably does not cost more than $10" which refers to the hardware specifically. The retail price would be higher than the hardware costs to cover software, support costs, returns, profit, shipping, credit card fees, and so on.

sowbug 8y ago

You are a web developer. Do you place any value on the cost of developing software?

spuz 8y ago
Yes of course, but the reason I mentioned the hardware cost is because that scales linearly with demand and software cost does not. The market for these kind of security devices is tiny right now but has the potential to be huge in the future. It would make sense for Google to sell their hardware at the lowest price they can in order to get people on board, after which network effects will ensure people stick with Google's services.

jiveturkey 8y ago

the secure element alone is $5 at million quantity

michaelt 8y ago
Do you think the chips they put inside smart cards and SIM cards cost that much?
spuz 8y ago
That's a lot! Where did you get that information?

kilo_bravo_3 8y ago

When selling hardware, unless you are extraordinarily dominant in a very large and highly competitive market (television manufacturing), care only about marketshare (lower-tier smartphone manufacturers), or have another revenue stream (game console sellers) generally speaking you should target 3x BOM as your final retail price at an absolute minimum. That's just for hunks of plastic. For complex (not a hunk of injected-molded plastic) devices with high non-BOM costs, you should be targeting 4x-5x at a minimum. Also, the 3x-5x rule is for bare-bones lean operations. If you actually want to make money, compensate your employees well, practice good environmental stewardship in the construction of your products, use a manufacturer that treats its employees with respect, and have a healthy business where you are prepared to weather future changes in the market, your BOM costs should be LESS THAN 20% of the MSRP. The model is also different if you are a Shenzhen ripoff factory dumping goods onto the market through Marketplace Sellers or Drop-Shippers. But that is not a model compatible with long-term prosperity or worker satisfaction.