Yubico: Secure Hardware vs. Open Source
&gt; we, as a product company<p>The most important thing any security company needs to realize is that their primary product is their reputation, not the physical or digital goods that they produce.  &quot;We, as a product company&quot; is totally the wrong attitude.  There&#x27;s really no question about it, every ounce of closed source software&#x2F;hardware in a security offering is something the customer should be concerned about it.<p>From a product perspective it totally makes sense to be worried about open sourcing the entire design.  &quot;Our competition will make clones!&quot;  And that may be true of every other kind of product.  But would you buy a cheap knockoff Yubikey?  I certainly wouldn&#x27;t.  Again, reputation is the key here.  That&#x27;s what a security company sells to their customers.  Confidence that when they buy from company X they know that company X has put the best engineers to the task and crafted a device that will protect their valuable digital information.<p>A company can build up a reputation in the security industry, produce world class hardware and software, and charge a sharp premium on it, because security is _so_ important and protects some of our most valuable assets.  That premium is completely derived from the trust that they&#x27;ve garnered.  It&#x27;s insane for Yubico to squander theirs under some false sense of IP security.<p>EDIT: And all that said, I totally understand where they&#x27;re coming from on some of their points.  They have to depend on chip manufacturers, and chip manufacturers are just the absolute worst when it comes to open source and security.  Sometimes there are hard constraints and compromises have to be made.  Most of cryptography is a trade-off.  So don&#x27;t take my comment to mean that designs absolutely have to be 100% open source.  That&#x27;s infeasible most of the time for hardware.  But Yubico should be striving for it and pressuring the market.