Yubico Forum

I ordered my first Yubikey from MashedLife when I first started using there site to save my passwords. I love it.

Imagine my surprise when my son told me how they now have them for only $10. I quickly sent away for 3 of them. Two static and 1 OTP key.

Well it just arrived today. OMG!!! It's something called a UMI with the same form factor, about twice as thick and a mechanical button. If you go to their website and order the one they have pictures of the backside of the original Yubikey.

This UMI is so thick that I couldn't even insert it into my USB port. It's too tight and I'm afraid to force it in and possibly damage my USB port. I plan on contacting MashedLife and requesting a refund.

Since I never inserted it into my USB port I'm unsure of the code that is generated. I tried searching for information on this UMI. I haven't had time to wade through all the UMI hits on Google.

So BEWARE of CHEAP rip offs!

Here are some Photos so you can see the difference.

http://www.flickr.com/photos/vectormax/ ... otostream/

They even use the old Yubikey instructions.

Very disappointed at MashedLife!

Alas, these things happen. All you can do about it - and I feel Yubicom already does this - is to maintain your openness and honesty.

Yubikeys will probably be promoted by IT (oriented) folks first. Most IT people are honest and honourable people and they fully appreciate the openness and simplicity of this key. In fact, it is the same openness and simplicity that makes it such an easy candidate to clone.

But clever IT people don't like it much when good idea's - especially the ones involving Open Source - are misused by what clearly are a bunch of copycats. I for one will not buy from copycats, unless the original manufacturer clearly overprices his stuff (this is not the case with Yubicom) and/or switches from an Open Source to a Close Source approach (which probably will not happen, but might it happen I will not advise this key anymore).

Yubicom can not patent their stuff: it uses common hardware components and public cryptography. They can not prevent copycats from doing their work - as a matter of fact, it can be seen as a bonus that it is possible to copy the concept, as it demonstrates that people who buy Yubikeys are not solely depending on Yubicom.

So, how does Yubicom survive? By offering openness, honesty, integrity and fast customer service. They will survive.

I ordered one for $10 a week ago and got it yesterday and it luckily still was a yubikey. But they told me before they were looking for a cheaper alternative to the yubikey, so I guess they are selling it now. Looks like they changed the pictures on the website partly now. Does this UMI key have a website, or is it a cheap Chinese clone with the same micro and firmware?

After some searching I found that this thing is named Umikey (umikey.com) and it looks like a complete clone of the yubikey. Strange thing is that the umikey test page even accepts my yubikey otp's.

The UMI key is a cheap rip off, and not nearly as good as the Yubikey! It has a MUCH longer OTP, and I can't find any description on the Internets of how the key is generated (like was done with the Yubikey and Security Now), so I really have no idea how secure it is at all. And if you don't know how the key is generated, really how secure is it? Also, when I plug it in, it is not recognized as a keyboard, like the Yubikey is---it changes the screen size of my browser (Firefox in Ubuntu) and messes it up so that when I move my mouse my browser moves too! I don't know what settings the key messes with, but is NOT a simple keyboard like the Yubikey. Umi can't even get the order correct, as I ordered a static Umi key, and it came as a OTP, and I've seen no instructions how to change it to a static key, which I think I'll give up on anyway, as it messes with my OS settings enough that I have to reboot after using it.

All indications are that the Umi Key is a cheap rip-off of the Yubikey, and not worth even the $10 they are asking--Stay away and order your keys from Yubico... it's worth the price.

Yes, for individuals this is a no-brainer. My guess is that the UMI's are being built expressly to appeal to sites like mashed life that want to use them as security trinkets and send them out in a B-to-C fashion for as cheap as conceivably possible. I bet if you were a big site that had a specific need, they'd help you out and send you a bunch of their cheap thing that would work for your exact scenario.

It certainly doesn't appeal to me at all, and I'd recommend anyone to avoid the el-cheapo hardware and poor service and supportability.

But I'm just saying, we all are not the intended target most likely. Chinese cheapo ripoffs exist because somewhere in the world, there's a market for shoddy stuff.

I have to add a bit more about the Umi key. After I posted stating how buggy it is, I got an email from Mashed life stating that they had a new 3.0 Umi key, which fixed a lot of the issues of the older (2.0) key. So I tried it out. Here's what I noticed: The 3.0 key starts with ecee, vs a 2.0 key that starts with eced. The 3.0 key is, in fact, a little slimmer, so I no longer worry about damaging my USB port trying to jam it in. I wouldn't exactly say it slides easily in, but I fixed mine with a exacto knife, and it slides in and out fine. I tested it on various OSs, and here is what is worth mentioning:
1) When you plug it in on Windows (I used XP Pro SP3), it autonavigates to Mashedlife. Meaning, it populates the start/run menu with the Mashed life URL, so the OS opens a browser pointed there. While this is irritating if you intended to use the key for anything but Mashed life, if you actually intend to use it with Mashed life, it is nice=good for my mom.
2) When I plugged it into a Mac Leopard OS, I got an error stating that the keyboard couldn't be identified, but it still auto-navigated to Mashed life, just like Windows did, and it worked fine. I'd call this usable.
3) In Ubuntu, it didn't mess up my OS or my Browser, like the 2.0 version did. I also got the same output in both the Ubuntu text-only mode, as in the graphical mode, which is what should happen. With the 2.0 key I got letters in text-only mode, and numbers (ascii letter equivalent representations) in the Graphical X mode. True, the 3.0 key did output an "1;5Q" every time I plugged the key in (before it spit out the Mashed life URL text), but I think that is the textual representation of trying to open the start/run menu, which doesn't exist. But the good thing is that it no longer screwed up my Ubuntu OS. So I'd again call this usable.

In short, the Yubikey is still a better designed key, but it's $30. If you are using multiple systems, especially Linux, I'd reommend the Yubikey. The Umi key is cheaper, and acts a little cheaper. But, if you just intend on using it for Mashed life only, and are sticking with Windows, like my mom, it is probably worth the $10.

Actually the fact that ripoffs start to show up maybe a good thing for yubikey. This means that the idea is spreading around and starts to be accepted.