A little over a year ago I discivered a Yubikey Replay Attack .  The YubiKey is a hardware authentication token that looks like a small USB memory stick, but it is actually a keyboard. With the command of an integrated touch button, the device can send a time-variant, secure login code as if it was typed in from a keyboard. And because USB-keyboards are standard on all computers the YubiKey works on all platforms and browsers without the need for client software.

I believe the YubiKey is the answer to many password / security problems we have. If you are not using a Yubikey are are not as safe as you could be. And it is easy.

Everyone should be using a Yubikey , LastPass and TrueCrypt.

I believe in the Trush NoOne  (TNO) ideal of information security. However, with a Yubikey you are required to trust Yubico. So,  If you can't trust them, you should Trust But Verify (TBV).  

Here is a simple script to verify Yubico has not slipped. About the only problem with Yubikey is the Replay Attack.

#use strict;
#use Yubico::Auth;
use LWP::Simple;

$id = "1";          # Your Yubikey ID here
$logfile = "./usedkeys";
@otp_list = "";
$x = 0;

open(LOG,">$logfile") || die("Can't open $logfile\n");

do {
        $x=$x+1;
        print "Press Key? ";    # Ask for input
        $otp = <STDIN>;         # Get input

        chop $otp;              # Chop off newline

        if ($opt ne "stop") {
                $url = "http://api.yubico.com/wsapi/verify?id=". $id ."&otp=". $otp;
                $req = get($url);

                chop $req;
                die "Request Error" unless $req;
                print LOG $x. " ". $id. " ". $otp. "\n". $req. "\n";
                push(@otp_list, $otp);
        }

} while ($otp ne "stop");       # Redo while wrong input
print LOG "\n>>> Re-pay the keys\n\n";
$x = 0;

foreach $reotp(@otp_list) {
        $x = $x+1;
        $url = "http://api.yubico.com/wsapi/verify?id=". $id ."&otp=". $reotp;
        $req = get($url);
        chop $req;

        print LOG $x. " ". $id. " ". $reotp. "\n". $req. "\n";
}
close(LOG);
print @otp_list. "\n";