After reading the post "http://forum.yubico.com/viewtopic.php?f=4&t=601&p=2459" I decided to purchase a swekey to evaluate it.
It was quite a good surprise, and I found a lot of good ideas in the product. I hope Yubico will be able to implement those features...
Shipping:
Shipping is fast and free.
I paid 5 Euros for Yubikey shipping while they used a £ 0.6 stamp to send it
Cost:
The swekey is shipped at $20 including shipping, the Yubikey costed me $30
Hardware:
The Yubikey's hardware looks far better than the Swekey's.
I really love the thin design of the Yubikey, the Swekey still use the classical USB port.
Installation:
No Installation required for the Ybikey.
Swekey's installation is automated under windows but you need to download an installer for mac and linux.
Usage:
No need to push a button to logon, the key is recognized and the OTP is generated transparently (++)
When you unplugged your swekey you are automatically logged out (++)
Lost Key:
Losing a Yubikey is a real pain.
You can purchase a backup swekey to replace immediately a lost swekey.
Once replaced the origial swekey becone unusable (I didn't try the feature to avoid destroying my original swekey)
I'm at home and I forgot my Key at the office:
No support for Yubikey
You can disable a swekey. Then it wont be required by most sites (unless the site has a very high security level).
Once plugged the swekey is automatically reactivated
Security:
You can generate a lot of Yubikey OTPs in a text file then use them later doing copy/paste.
This can be considered unsafe since you can login without the Yubikey plugged in your computer.
Swekey works in challenge/response mode, so a generated OTP can never be reused.
Security:
You can generate a lot of Yubikey OTPs in a text file then use them later doing copy/paste.
This can be considered unsafe since you can login without the Yubikey plugged in your computer.
Swekey works in challenge/response mode, so a generated OTP can never be reused.
The Yubikey does not protect you against 'man in the middle/phishing' attacks, the swekey does because its OTP is calculated using the hostname of the remote site.
Of course this protection is usefull only using https sites.
Misc features:
As a corporate we planned to use the Yubico to protect our intranet. The swekey can let you choose to open your intranet webpage as soon as you plug it (The feature did not work for Linux)