They come in three different variants (princes are single unit prices, volumes are cheaper). As a result, all OSes more recent than MS-DOS support it out of the box. From the operating system point of view they present themselves as a USB keyboard: The Yubikeys have a small touchpad, if that is touched the generated password is emitted via 'keyboard input'. Yubikeys are a simple, robust USB form factor. Developed by people deeply involved in the FOSS and security communities.FOSS-friendly, entire software stack is open source and included in Debian (all enduser tools are also available on Mac OS X).Yubikey, as produced by Yubico is the most sensible hardware option: Hardware choice for an authentication token: The hardware design of the authentication tokens ensures that keys cannot be extracted, so in case of a compromised notebook the attacker does not have access to the second factor. If somone compromises a notebook of a user with cluster access, the attacker can steal the SSH key/passphrase and access the cluster. The important security property to gain is protection against compromised notebooks endpoint security is one of the biggest risks for the WMF cluster (especially on Mac OS X). Summarising some bits already mentioned at the offsite along with further tests done and a plan how to move forward (see below).

Yubikey alternative open source