Designing and Producing 2FA tokens to Sell on Amazon

https://conorpp.com/2016/09/23/designing-and-producing-2fa-tokens-to-sell-on-amazon/

by conorpp • 10 years ago

255 109 10 years ago

sekasi• 10 years ago

Really great writeup man, and for a good cause too. I've done something remarkably similar but solely for myself, and it's great to see someone going one step further.

Best of luck, hope you make your money back and get a nice kicker in the end to fund a few late night college parties.

conorpp8• 10 years ago

Thank you!

StavrosK4• 10 years ago

This is fantastic, very useful stuff. I literally just finished writing a similar post:

https://www.stavros.io/posts/making-gsm-board/

Conor, can you detail how the assembly is done a bit? I've made a few boards with KiCAD but I have no idea how to go from bare PCB to assembled PCB, especially for such low cost as yours.

I went to PCBcart but counting all the items on my board was a hassle, and I got a cost of $38 per board for a run of ten, which sounds too expensive. Besides that, how do you even export the BOM from KiCAD? It doesn't come with a plugin by default.

A few details or a post on how to go from PCB design to assembled board would be very useful, at least to me.

conorpp8• 10 years ago

Thank you!

Assembly depends on the service you end up using. For PCBCart, I think I just ended up filling out their template BOM manually. Not much of a hassle since I only have 8 parts. I just had to match the component references on the PCB to the BOM, count the number of pins, provide part number, etc. They figured everything else out, just a question or two on part polarities.

Yeah getting boards assembled for small volumes will likely not be cost effective. You can mess around with online quote tools to get an ideal if it'd be worth it or not. Using parts with pins that extend out from the package (rather than underneath) will always be more cost effective. Less pins is cheaper too.

StavrosK4• 10 years ago

Ah, thanks for the info!

trav42252• 10 years ago

Interesting -- I (incorrectly?) assumed this would need to be approved by several regulatory bodies in order to be legal to sell...

kbaker4• 10 years ago

Well, technically, since this device contains a clock, it should go through FCC Part 15 Verification before being sold. However, the FCC doesn't really have the budget to go after every board produced, you have to REALLY mess up to get on their radar...

Since it is USB based, it should technically go through USB-IF interoperability testing, if he wants to use the USB logo. Though actually it looks like he has a VID/PID allocated from SiLabs for this, which is already way better than a lot of inexpensive USB products.

conorpp8• 10 years ago

Yeah I'm not sure about the legals and just figured it would be fine. I did get a VID/PID from SiLabs which has already done USB certification for the chip.

FIDO U2F also has a $10k certification process to allow you to use the FIDO logo. I don't think it's worth pursuing for me.

alister• 10 years ago

I am not actually concerned with financial success or growth. The nice thing about this project is I can just let it sit and I don’t need to maintain anything – leaving me time to move on to the next project.

You should pursue this product -- you have huge possibilities here.

You heard of a company called Security Dynamics? They invented the little token with ever-changing 6-digit numbers that you have to enter to login to your remote office computer. You probably know it today as the RSA SecurID[1]. They created a billion-dollar market and made the founders fabulously rich.

I know that there are other U2F products out there, but you can make yours unique, different in some way, or targeted to different market. Or just compete as an alternative to the larger companies making U2F keys (which are not really that large yet anyway).

Surely continuing this product is better than the "working in government" job you're seeking.

[1] https://upload.wikimedia.org/wikipedia/commons/3/33/RSA-Secu...

conorpp8• 10 years ago

Thanks! I didn't know about Security Dynamics.

I think there's a lot of neat improvements you can make on 2FA products for different markets. But it's kind of at the point where if I wanted to continue working on a better 2FA token, I would have to get funding and do it full time. Although it's always tempting, I'm not sure I want to "cash out" of school and regular life just yet.

Also if I don't work in government I'd be in a lot of debt to pay back school. So that's an additional hurdle.

mikekij4• 10 years ago

Great work, Connor. I have spent considerable time thinking about the federal student loan forgiveness you're referring to. I'd love to share. Email me at mike at medcrypt dot co if you're interested.

pjc50• 10 years ago

I think you're being very sensible about this. As the parent poster says, you need to have a distinguishing feature if you want to turn this into a product to compete with e.g. Yubikey. But as a resume/CV for getting you a job? It's fantastic. Bring it to interviews. Show it to people at trade shows. Get an embedded systems or electronics job. Profit.

jamiesonbecker2• 10 years ago

I started soldering one of these one night (ordered enough parts for 9 of them) and realized that these things are really, REALLY tiny. Even with a magnifying glass, it's hard to even tell where the pins are, but I got about half of it soldered.. looking forward to the other half. :)

Huge thank you to Conor for building this whole thing and open sourcing it and even providing links to pre-fab PCB's. Incredible work. Also the PCB's look really cool.

I think I'll buy a few to go along with the one I just made.. :)

StavrosK4• 10 years ago

You hand-soldered a QSOP package? How did you manage that? :)

mcpherrinm2• 10 years ago

It's not too hard if you have a proper PCB with solder resist. The surface tension of the solder causes it too glob onto your part's pins and the pads below them. The solder resist is really key here, or else it's essentially impossible.

You will have to test for solder bridges between pins, and maybe use some solder wick to get any excess out.

It's not super fast, but it's absolutely doable with an hour or two of practice. Solder paste and a heat gun is the next step up, which I find more difficult to get right (I'm bad at applying the paste).

kbaker4• 10 years ago

Looks good. Consider applying a conformal coating at the end. It will provide a lot of protection from general handling and riding around on a keychain, and preserve the 'raw PCB' look.

Something like: http://www.mgchemicals.com/products/conformal-coatings/acryl...

toomanybeersies• 10 years ago

Conformal coating also has the bonus advantage that it fluoresces and looks awesome under UV light (and sometimes even just from the UV from sunlight).

It also waterproofs the board too, which is a bit more useful.

Animats8• 10 years ago

Case. Must have case. A bare board is not a consumer product. Consider just dipping the thing in Plasti-Dip, without submerging the connector. For a better feel, put the button on the solder side side, and put a thin piece of plastic U-channel sized to fit the board over the component side to give it a flat surface. Then Plasti-Dip. No custom injection molding, and the user can still push the button through the Plasti-Dip.

Other than that, great idea. It's how PayPal started.

conorpp8• 10 years ago

I agree. The problem is trying to do this at scale. I don't want to do it myself as it would be too time consuming and messy.

Without having the funds for injection/pressure molding, I haven't been able to find a good solution. Maybe there are cost effective services that would work like PCB potting or overmolding.

One service that I found that looks promising is Cavist:

http://cavist.com/

But I haven't gone down this route or found someone that has. I might do this later on.

Animats8• 10 years ago

Look for someone who's already encapsulated USB devices. They might be able to reuse an existing mold. That business is all tooling cost; per-unit cost is tiny.

But don't send the job to China, or your device will be copied, cheaper.

AstroJetson2• 10 years ago

+1 on the case being a must have. I'll put some shrink tube over the ones I just ordered to keep them from getting banged up. Looking forward to trying it out in a few days.

Animats8• 10 years ago

Good idea, but I see ads in that sector saying "Molds start at $4990".

I've seen people do things like this at TechShop. They carve a positive mold out of maybe a dense wood. Then use that to make an negative mold out of some pourable plastic like RTV. Then insert the device, pour in epoxy, and wait for it to cure. The negative molds wear out fast, but you can make more from the positives. There are lots of plastic options and books on this stuff. People use these processes to turn out stuff to sell on Etsy. All this is do-able, but usually messy.

Still, struggling through the process to have an MVP to show resellers is worth the trouble. If you get a big order, you can go out to Cavist or someone like them and have them produce in volume.

Animats8• 10 years ago

Here's an option. There are companies in China which sell standard enclosures for USB plug-in devices. They'll even throw in a color of your choice and a sticker. You'd have to redesign your board to fit their case, but that may be a lot easier than dealing with encapsulation.[1]

[1] https://www.aliexpress.com/item/1-pcs-szomk-white-small-usb-...

kbaker4• 10 years ago

You may want to consider something like this, even though maybe it would take too much time, it would look awesome.

http://runawaybrainz.blogspot.co.uk/2012/04/audio-crystal-cm...

ladyada• 10 years ago

You may be able to use one of these

http://www.digikey.com/product-detail/en/bud-industries/USB-...

it looks rather cute! see: https://blog.adafruit.com/2011/03/04/part-finder-friday-clea...

board respin required...either position the button so you squeeze the enclosure to press the button (it flexes a bit), or drill a small hole (use a jig to get the drill bit in the right location

enclosure co's will also customize/drill holes for you but its probably easier for you to just diy!

Hyperborian• 10 years ago

One super cheap idea that might be worth considering: clear shrink tubing. You could put whole trays of them at a time in your oven, just make sure the tubing is the right length and lined up right.

You might even be able to get away with not cutting out a hole for the button, as it could be activated through the flexible tubing.

Dwolb• 10 years ago

Honestly I think you're fine right now. Think of this initial run as a market test. If you end up selling out your entire stock, tell friends and family that you need a small loan and work with someone domestic to get your enclosure done.

Polycase might be a good place to start once you sell out. They sell generic cases and will quote you on modifications to their existing USB case.

After that (if you continue to sell out), you're probably a real business. Keep the domestic machine running and hop over to China to explore driving costs down. Probably explore what type of software/service might complement your hardware to drive recurring revenue. Create custom single unit packaging and bulk delivery packaging for consumer selling and business selling.

pgrote• 10 years ago

I am considering buying one. Was your plastidip suggestion legitimate? Should I just hold the connector and dip it into the plastidip? Thanks.

Animats8• 10 years ago

It's serious, but there's the possibility that Plasti-Dip might get into the interior of the button and insulate it so it doesn't work. You need sealed buttons. Some surface-mount buttons are sealed.[1] Many are not. I was thinking more from the point of view of what simple manufacturing step could the maker add to package the thing. Shrink-tube sounds good, although it might hold the button down if shrunk too hard.

[1] https://www.omron.com/ecb/products/sw/24/b3s.html

homero3• 10 years ago

Potting would be great too but very messy and the button must stay above

Animats8• 10 years ago

Use a potting mold with a tube sticking through it and down to the button, and a button with a long plunger.

akhatri_aus2• 10 years ago

Just buy some Sugru and use that. Doesn't seem much of a problem.

ascorbic4• 10 years ago

I'd price that up before suggesting it.

w8rbt• 10 years ago

Heat shrink tube might be an option. Although I don't know how durable it would be over the long haul.

Mizza• 10 years ago

At the risk of sounding like a complete schmuck - how do I actually use this?

It look like it's a dev board, the kind of thing I'd get on SparkFun or whatever, but I get the impression it's a consumer product. Do I plug it into my computer, and it runs software? Do I press the button, then it blinks out a password via LED at me? Does it connect via bluetooth to.. something? Who writes the local software? You? Google? Me?

I love your write-up and I dig your hustle, but I think the final 10% "polish" is the missing piece here! Good luck!

conorpp8• 10 years ago

Haha good question.

Yubico has a good explanation:

https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

It's the same as any other U2F token. You register it with a service that supports U2F (Google, Github, Duo, etc.) and then present the token and press the button upon logging in later.

No software or drivers needed. It's an HID device so all normal operating systems will support it.

rattray4• 10 years ago

Ummm... can you please include an explanation on your website that makes sense to non-developers who haven't heard of either Yubico or U2F before?

"It's the same as any other U2F token" is meaningless to a rather significant proportion of humanity.

homero3• 10 years ago

You push the button and it'll send 6 digits as a keyboard it's like 2fa

sowbug• 10 years ago

That's not correct. A U2F device cryptographically signs signed challenges with a key that never leaves the device. (Yes, it signs a signed challenge. That's not a typo.) The issuer of the challenge verifies both signatures to confirm that the user possesses the device and that the issuer genuinely issued the challenge embedded in the signed response.

Unlike the OTP token you're describing, a U2F device is effectively stateless. And unlike an OTP token, its signing mechanism is resistant to phishing. Finally, a U2F device is not a HID keyboard, contrary to your other comment on this page. But it is a HID-compliant device.

leetbulb• 10 years ago

How cool, just ordered a few!

bigiain• 10 years ago

I was going to:

"This item does not ship to Australia"

conorpp8• 10 years ago

I'm naive and didn't realize Amazon wouldn't ship internationally by default. I just updated the listing to enable international shipping which should take effect in a couple days. Thanks!

dawnerd• 10 years ago

Ordered one myself too. 8 bucks is way cheap enough just to look at the thing. Assuming it works (no reason to think it wont) I'd pay more.

lisper4• 10 years ago

I am doing something similar but much more powerful and versatile (and more expensive):

https://sc4.us/hsm/index.html

I actually have a new batch of prototypes and I'm just putting the finishing touches on my e-commerce code (I'm using Stripe and Easypost rather than Amazon). The plan is to finish that tonight and start taking orders again on Monday.

lisper4• 10 years ago

UPDATE: The site is up. SC4-HSM prototypes are now available to order.

NetStrikeForce2• 10 years ago

I had a look at the link, but I don't know yet what are the use cases for your device.

Care to explain why would I want one?

Thanks!

lisper4• 10 years ago

Think of it as an Arduino for security. I can be programmed to act like a U2F token, a bitcoin wallet, secure storage for ssh keys, etc. A future version will have a second USB port so it can turn a regular USB thumb drive into an encrypted drive, act as a "USB condom" between your computer and a suspect USB device, or turn a regular keyboard into a smart keyboard that can generate and play back secure passwords. Because it has local I/O (a display and two buttons) it can do all of these things while remaining secure against an adversary that pwns the machine it is plugged in to. And because it uses stock hardware and is user-programmable you can be fairly confident that it doesn't have any back doors built in to it.

Of course, it doens't actually do most of those things yet (working on getting the bugs out of the U2F code right now) which is why right now it's just a toy for hackers and devs. But the apps are coming.

akhilcacharya• 10 years ago

I've been interested in building hardware-for-crypto too, great write up!

happy-go-lucky3• 10 years ago

Isn't mobile phone 2FA more advantageous?

fixxer• 10 years ago

Yes, in the sense of convenience... but you are storing the generator on a networked device with potential for malicious exploitation. OK for my gmail, but maybe not the keys to a 6 figure brokerage account... Of course, in the case, I'm getting issued a key from the brokerage.

happy-go-lucky3• 10 years ago

OK, the token security outweighs the usability.

jnpatel• 10 years ago

If you leave your U2F key in your laptop or PC, I find it to be much more convenient than mobile 2FA. Just one tap and you're in... versus pulling out your phone, unlocking, and typing in the code.

Btw, all U2F services allow you to fall back to phone 2FA if you're on an unsupported device.

sliken3• 10 years ago

Better smartphone auth setups doesn't require typing in the code. Like Duo Push.

lorenzhs3• 10 years ago

No, as U2F prevents nearly all phishing attacks. See this post on FastMail's blog (the last section): https://blog.fastmail.com/2016/07/23/how-u2f-security-keys-w...

happy-go-lucky3• 10 years ago

Of course, I don't deny there're security benefits, but IMHO it's worth mentioning that there're some trade-offs.

Well, of course there are always tradeoffs. The biggest one right now is that Google Chrome is the only major browser that supports U2F.
Because it requires browser support to act as an intermediary between the website and the security key, you can only use it if the browser supports it.
Mobile is also an issue, as they don't have USB ports!
Some YubiKeys support U2F via wireless NFC, but support for this in mobile phones is very limited at the moment.

sliken3• 10 years ago

Generally I trust my U2F that has a simple button on it to not reveal it's private key much more so than a hugely complicated smartphone.

Especially the button, which makes it very hard for a remote attacker to get anything from the U2F token.

How many apps are on your phone? How secure is the software stack? Kernel? Hardware? Drivers? If android, how good is your manufacturer + cell provider at distributing the latest updates? Can you prove that an app can't see the screen and send a touch event?

Also generally it's faster to hit the single button on a U2F widget than it is to do anything with a smartphone.

rattray4• 10 years ago

Looks like it's basically this: https://www.amazon.com/Yubico-Y-123-FIDO-U2F-Security/dp/B00... but $8 instead of $18, open-source, and far more "stylish".

Cool.

rattray4• 10 years ago

Hmm, this product may be more practical if you're okay with closed source for this purpose: https://www.amazon.com/HyperFido-K5-FIDO-U2F-Security/dp/B00...

Still, cool.

VeXocide• 10 years ago

If a coating of plasti-dip is an option check whether it's possible to add glitter to it as tamper-proofing, similar to https://www.wired.com/2013/12/better-data-security-nail-poli...

cavisne2• 10 years ago

Very cool, I love how this is an end to end FBA business with (it sounds like) very little upfront cost.

Is getting the 2 day shipping a function of just price of the item or something else?

I wonder because the most direct competitor

https://www.amazon.com/HyperFido-K5-FIDO-U2F-Security/dp/B00...

gets the 2 day shipping and is only a few $'s more.

The difference between $8-10 is nothing really, if I was shopping for one of these and saw yours for the same price I would buy it because I like the exposed/no case design (and I think a lot of the "early adopter" people buying these tokens for personal use would be the same). So maybe you should bump the price up a bit.

joemi• 10 years ago

Not really sure exactly what you mean, but unless I'm mistaken, all FBA items have all shipping methods Amazon offers, since they're being shipped from Amazon's warehouses just like all of Amazon's products.

cavisne2• 10 years ago

Right, maybe it's location based but from my account I see Prime (2 days) for the linked product, and Prime (5 days) for the zero

danieltillett3• 10 years ago

I have a question about these tokens - what happens if they break? Are you effectively locked out? Is it possible to have two identical tokens so that if one breaks you can use the other?

craftkiller• 10 years ago

You can often times have multiple different keys registered to a single account. I have a yubikey nano stashed away as my backup key if the one on my keychain breaks or is lost.

danieltillett3• 10 years ago

Thanks. I have quite a few services that only let me register one key. I always worry that if I lose my phone (or break it) I am going to be locked out.

conorpp8• 10 years ago

A good idea is to store backup codes some place safe. You can use them as one time 2nd factors. Then you can then either disable 2FA, or more preferably, register a different 2FA option.

thoughtpalette• 10 years ago

I love this. Great article/read/product.

One thing to note, on your site https://u2fzero.com/ there's around 50 line break tags at the bottom. Shows an entire screen of white space for me :|

fragmede• 10 years ago

Pricing things well is a dark art, but I think you could stand to raise the price some.

jerkstate• 10 years ago

It seems like the price is too low, if your actual margin is only 25%. As a customer I would also be concerned about how to carry it without damaging it, given that there's no case. Do you have any recommendations?

You might also want to add some keywords like "fido usb yubikey" to your product page too.

frederikvs2• 10 years ago

Could use a comparison to e.g. a yubikey [0]. At this price, I can afford to just order one and see what happens, but still it would be nice to know what features I'm sacrificing for the cheaper price.

[0] https://www.yubico.com/products/yubikey-hardware/yubikey4/

jon-wood2• 10 years ago

You're sacrificing everything the Yubikey does beyond U2F. Yubikey can support U2F, but also generates one time passwords, and appears as a smart card to your operating system allowing you to keep PGP/SSH keys on it.

ascorbic4• 10 years ago

A better comparison is the Yubico Fido U2F key, which just does U2F. https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

mmorris• 10 years ago

I'm by no means an entrepreneur but I'd like to keep trying to be one.

Your imposter syndrome is showing! Designing and building a tool like this and selling it qualifies you as an entrepreneur.

Get a low-cost marketing channel going (or improve your margins to make other marketing options feasible) and see how far you can run with this.

Thanks for the interesting read.

gravypod2• 10 years ago

How hot does this get? If I just put this in a putty-epoxy will I "cook" it?

Edit: Can I also use this as 2FA for SSH/Desktop login on my Arch install? I've never done 2FA but I've always wanted to.

captn3m0• 10 years ago

For my yubikey, I've got a couple of scripts that kill and boot my i3lock when I plug and unplug it. I haven't setup desktop login on it though, because that would be too risky for me.

If this stores GPG, then you could do SSH as well. Edit: Reading the comments, looks like it only does core U2F, so no SSH for sure. I'm not sure if there is a U2F module for PAM yet.

gravypod2• 10 years ago

Well by "do login" I meant to basically require that + password. It's good to see it's possible.

I've been toying with the idea of buying a dock for my thinkpad and using it as my main system retiring my current low-powered desktop as a server.

My main concern is that, since I keep important docs on my system, I'd now be carrying them with me. Doing 2FA for harddrive decryption and system login would be amazing for me since then I'd be able to know that even if my computer is stolen the "attacker" won't really have the means to login.

sliken3• 10 years ago

Generally U2F widgets don't run code or have any extra functionality unless they specifically mention it.

The OP key looks pretty barebones I wouldn't expect it to generate/store/use ssh or pgp private keys. That's more like a yubi key 4 or similar more expensive widgets that are basically smartcards and/or HSMs.

There is a U2F pam module that can allow you to use a U2F widget for screen unlock, login, sudo and the like. If you are worried about the U2F dying/being stolen/lost then you could always authorize more than one U2F widget and keep one in a safe place.

taejo• 10 years ago

BTW, Amazon seems to think they're storage devices, and is offering data recovery plans.

mrgreenfur• 10 years ago

Love it and want to buy one, can I buy direct from you? (I have a thing against Amazon).

Edit: For auth on a phone / small device, could you make a version with a miniusb plug?

mrlambchop• 10 years ago

Ordered 2 of - great write up.

Just pondering - did you disable JTAG on these devices before distributing them?

Designing and Producing 2FA tokens to Sell on Amazon

Related Stories