a16z Podcast | The Hard Things about Security

Company and Product Origins

• Yubico was founded by Stina Ehrensvard (CEO, product design background) and her husband Jacob Ehrensvard (electronic computer engineer, founder market fit).
• The technology originated from a failed attempt to create intelligent pharmaceutical packaging; the need to securely transmit data from the package led to the development of the YubiKey.
• The initial prototype solved the "driver problem" of smart cards by functioning as a standard keyboard input, allowing the device to generate encrypted one-time passcodes without requiring software drivers.

Security Philosophy and Hardware vs. Software

• Hardware tokens are prioritized over software-based security because software relies on "turtles all the way down" (software protecting software), whereas hardware offers a physical root of trust that can be secured independently.
• Biometrics (fingerprint, retina) are deemed insecure for primary authentication because credentials are immutable; if stolen (e.g., the OPM breach), they cannot be reset or replaced.
• SIM cards and phone numbers are vulnerable to social engineering attacks (e.g., porting numbers at carrier stores), whereas physical keys can be locked away or replaced via standard recovery protocols.
• The company advocates for "public key cryptography" within hardware tokens, which generates unique passcodes per use, unlike reusable software passwords or copyable biometric data.

Adoption of Open Standards and FIDO/U2F

• Yubico approached Google to solve phishing and session hijacking; they proposed a solution combining one-time passwords with public key crypto and NFC.
• Google adopted the standard (initially named U2F for "Universal Second Factor"), and upon deployment, reported zero phishing attempts among staff and contractors.
• Yubico contributed the U2F code to the FIDO Alliance, an open standards consortium that includes 200+ entities (Microsoft, PayPal, Bank of America, Visa).
• The current FIDO protocol is projected to have an impact on internet security comparable to SSL, establishing distributed trust without centralized control or government oversight.
• Stina predicts that by the end of the year, YubiKeys will be usable for banking and US government services without sharing user data between platforms.

Usability, Design, and Market Strategy

• Yubico adopted an open-source strategy early on after journalist Steve Gibson misinterpreted their status as open source; this decision secured their first 100,000 users and attracted early adopters, including employees at Google.
• The design philosophy targets "ubiquitous computing" (Mark Weiser's concept), aiming for devices that are flat, waterproof, crush-safe, and small enough to be worn as jewelry or embedded in credit cards.
• Production focuses on mass scalability, utilizing robots to keep costs low for global distribution.
• Unlike traditional enterprise security sales, Yubico relies on organic, bottom-up adoption driven by developer communities and consumer usability.

Entrepreneurial Challenges and Cultural Dynamics

• Founding in Sweden offered a safety net and a culture of frank, flat-hierarchy technical debate, contrasting with Silicon Valley's boldness and willingness to embrace large visions.
• The company faced initial rejection from investors in the US for lacking a proven track record, prompting a strategy of achieving profitability and customer traction first.
• Stina secured funding only after demonstrating customer success; Ram Shalgram (Google Board Member) eventually invested after seeing the company's traction.
• Communication breakdowns are identified as the primary source of startup errors, emphasizing the need to avoid assumptions and clearly articulate goals to all stakeholders.

Future Trends and Hardware Specialization

• The industry is moving toward "passwordless" authentication, combining hardware tokens with biometrics, geolocation, or other factors for multi-layered security.
• Hardware roots of trust are expanding beyond user authentication to device-to-device and server-to-server communication, particularly in IoT and autonomous systems.
• Google's "Titan chip" represents a shift toward hyper-specialized security hardware on a separate die to mitigate risks like the Meltdown vulnerability found in integrated processors.
• Stina notes that the internet was designed for sharing, not security; the solution involves isolating sensitive credentials in dedicated hardware rather than attempting to secure the entire software stack.

Forward-Looking Statements and Industry Outlook

• Stina predicts the integration of YubiKey functionality directly into credit cards and other embedded chips as technology matures.
• The company views the adoption curve as slow due to legacy behaviors and organizational image concerns, where admitting the need for third-party security is seen as an admission of insecurity.
• Despite 10+ years in the market, Stina characterizes Yubico's growth as an "overnight success" to highlight the long, hard slog required to reach mainstream adoption.
• The ultimate vision is a world where security is distributed, open, and invisible, functioning as a universal standard rather than a proprietary black box.