<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div><div><div>On Apr 13, 2016, at 8:56 AM, Tony Arcieri <<a href="mailto:bascule@gmail.com">bascule@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Wed, Apr 13, 2016 at 2:06 AM, Thierry Moreau <span dir="ltr"><<a href="mailto:thierry.moreau@connotech.com" target="_blank">thierry.moreau@connotech.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Who wants to be optimistic with respect to threat models in the current IT landscape?</blockquote><div><br></div><div>I prefer to be realistic about threats, especially when UX tradeoffs are involved </div></div></div></div></blockquote><br></div><div>Everyone needs to choose their own risk posture, and different applications have different needs. There are certainly people out there for whom Yubikeys are adequate, and for whom the SC4-HSM won’t make sense. But I believe that there are applications and not-entirely-unreasonable risk postures for which a Yubikey might not be adequate. If nothing else, having a programmable USB dongle with a display makes kind of a cool toy to noodle around with.</div></div><div><br></div><div>Tony: I really don’t mind negative feedback when it’s constructive. In fact, I very much appreciate it. But I’m really having a hard time discerning a constructive purpose in your critique. What exactly do you think that I should be doing differently? Change the design? Give up and join you in being an evangelist for Yubikeys? Something else? I really don’t get it.</div></div><div><br></div><div>rg</div><div><br></div></body></html>