Why You Might Not Want One
Our biggest complaint is one of trust: We never felt completely comfortable relying solely on the token. One reason was that we encountered issues with template settings that caused new passwords to be generated without initiation. To be fair, we were constantly creating new templates, associating them with our token and then running tests, which is atypical. We also had problems with passwords that we entered manually via the Policy Master software; we couldn’t edit the passwords using the token’s directional buttons. We could not auto-generate new passwords for these records; the token generated only a blank field or, in some instances, two or three characters that didn’t fit any default password guidelines or any others we’d specified. Mandylion is aware of this last issue and says it plans to address it in a later release.

Many organizations rely on users to change their passwords. That’s how the Mandylion token is designed, too. But administrators can’t ensure users actually are updating passwords, unless password policy is assigned on the server.

Entering log-in records is easy. However, typing in new records or editing existing ones on the token was a task we quickly learned to avoid. The token’s gum-rubber buttons are not particularly responsive, and scrolling through 50 records could drive even the most patient CIO to tears. To edit an existing record, you must scroll through the entire alphabet until you find what you’re looking for.

Like the token’s password field, both the account name and user or log-in name fields are limited to 14 characters. This was frustrating, as we have several longer log-ins.

Since the token doesn’t communicate with the user’s PC or even the Policy Master template beyond the unilateral communications when transferring records, an administrator has no way to know if a token is compromised. You can’t know whether the device was stolen and is being hacked, or if it rolled under a user’s car seat.

The size and shape of the Mandylion token is suitable. If you don’t keep very many keys on your key ring it won’t be a problem, but it was somewhat awkward when attached to a ring with many keys. The token also feels rather delicate; after only a week and a half of regular use, it was a bit dinged up.

Finally, Mandylion’s password manager works only with PCs, so Mac and Linux users will want to steer clear.