Yubico Forum

Is there a way to check that YubiKey shipped by store.yubico.com is the same YubiKey as it indeed?

I received my YubiKey in the small cover with number label (which is the same as in invoice) but gold disc looks very shabby and has scratches. Like it was used a long time before. So I want to check that courier/broker did not replace the device with own one.

Is it possible that store.yubico.com just sent used YubiKey 4 (because I applied GitHub discount)? It is not important if such scratches are OK for all or most devices from store.yubico.com but I just afraid that the device is not original.

You can contact order@yubico.com if you wish to initiate a return. I've seen scratches on plenty of new YubiKeys in the button area. The area to be concerned about is the USB contact area. You'll see scuffing on the contact area after only a few removals and insertions. The damage in both cases is in the outer oxidation layer and nothing to worry about (from a functionality standpoint). For piece of mind there are also several checks you can run to see if any changes have been made:

- Personalization Tool should show only slot 1 is configured
- test at demo.yubico.com with an identity beginning with "cccccc" should pass (if both things happen, the identity is original)
- do a test registration at demo.yubico.com/u2f
- if you have gpg installed, gpg --card-status should show no identities loaded
- running YubiKey PIV Manager should bring up an initialization dialogue and allow you to set a PIN
- Yubico Authenticator can be run to ensure no identities are stored (should say "no credentials available")

Thank you! It gives me details which I wanted to know.