Yubico Forum
https://forum.yubico.com/

[SOLVED] How to check that shipped YubiKey is valid?
https://forum.yubico.com/viewtopic.php?f=4&t=2462		 Page 1 of 1
Author:  crazyh [ Thu Oct 20, 2016 12:49 pm ]
Post subject:  [SOLVED] How to check that shipped YubiKey is valid?
Is there a way to check that YubiKey shipped by store.yubico.com is the same YubiKey as it indeed?

I received my YubiKey in the small cover with number label (which is the same as in invoice) but gold disc looks very shabby and has scratches. Like it was used a long time before. So I want to check that courier/broker did not replace the device with own one.

Is it possible that store.yubico.com just sent used YubiKey 4 (because I applied GitHub discount)? It is not important if such scratches are OK for all or most devices from store.yubico.com but I just afraid that the device is not original.

Attachments:
File comment: Gold disc is shabby, contains scratches and some kind of ghost circle (from finger?) inside.
IMAG0640.jpg
IMAG0640.jpg [ 2.02 MiB | Viewed 1617 times ]
Author:  ChrisHalos [ Thu Oct 20, 2016 11:33 pm ]
Post subject:  Re: [QUESTION] How to check if shipped YubiKey is valid?
You can contact order@yubico.com if you wish to initiate a return. I've seen scratches on plenty of new YubiKeys in the button area. The area to be concerned about is the USB contact area. You'll see scuffing on the contact area after only a few removals and insertions. The damage in both cases is in the outer oxidation layer and nothing to worry about (from a functionality standpoint). For piece of mind there are also several checks you can run to see if any changes have been made:

- Personalization Tool should show only slot 1 is configured
- test at demo.yubico.com with an identity beginning with "cccccc" should pass (if both things happen, the identity is original)
- do a test registration at demo.yubico.com/u2f
- if you have gpg installed, gpg --card-status should show no identities loaded
- running YubiKey PIV Manager should bring up an initialization dialogue and allow you to set a PIN
- Yubico Authenticator can be run to ensure no identities are stored (should say "no credentials available")
Author:  crazyh [ Fri Oct 21, 2016 11:01 am ]
Post subject:  Re: [QUESTION] How to check if shipped YubiKey is valid?
ChrisHalos wrote:
For piece of mind there are also several checks you can run to see if any changes have been made
Thank you! It gives me details which I wanted to know.
Page 1 of 1 All times are UTC + 1 hour
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/