Assuming their implementation is legit. Have you seen anyone actually audit it?
I think the idea is that a govt agency looking to get backdoors added is more likely to target Intel (used by everyone) than some guy making those keys in his garage. I suppose you could do some limited auditing by disconnecting the noise generator built into the key, and seeing if the output changes.
I've seen other similar RNG key devices. Long been interested in them for other reasons and analyzing the impact of forces on RNG generation.
This is silly. EntropyKey is reasonably priced given its low volume nature, but a serious product of this sort has a security barrier around the RNG and a crypto processor inside the barrier, so the raw random bits in a crypto protocol are never visible to the host computer (which is treated as insecure in this context). That type of product goes up into the kilobucks largely because of mumbo jumbo and certifications, but starts in the pennies (GSM sim cards have this functionality right on the chip). If you really want an RNG on a USB port for some reason, the simplest way is a smart card using its internal RNG. If you want something totally FOSS, you could program a Digispark ( http://digistump.com/products/1 ) or Trinket ( http://www.adafruit.com/products/1501 ) to collect randomness from an analog noise source on one of its A/D converter pins, and distill it with a hash function running in the microcontroller. Maybe I'll code up something like that since people seem to want it.
