Why I don't like smartcards, HSMs, YubiKeys, etc.
HSMs are shit.In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined.We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy:1. A license from the LB vendor to use the HSM2. A licence from the HSM vendor to use EC with the LB.... even though they trumpeted these announcements of how radically great they were together we found:1. The integration didn't work, full stop.2. The version of OpenSSL we had to use (supplied) was about 18 months out of date3. The specially b0rked version of OpenSSL supplied didn't support EC via a HSMEven better - when Heartbleed came out I had a patch from RedHat on day 1. The load balancer?Nope - nothing on their website - I had to create a ticket which said 'we are aware of the issue', at which point the ticket was closed. I questioned this and was told they couldn't keep it open, I had to create a new ticket every few weeks to find out whether they'd actually deigned to assign a bug id to the issue.The HSM vendor just said nothing, zero, until a new version of the firmware was silently released 4 months later.The whole industry is shit. I'd rather have a farm of Yubikeys than one of those HSMs.