I don't really see what's new here, that made the author "withdraw his endorsement". It's an issue from 2014, about a device that has always been fully proprietary? Ok, so they make <i>other</i> devices that was in some small way open, and ran Free software. Great. But the yubikey devices have <i>never</i> AFAIK really been open in any meaningful sense. So, really this isn't so much yubikey changing what they do, but rather the author not understanding what these devices were in the first place?<p>As far as I can tell, if you got one of these in the mail, there'd be no meaningful way you could verify that it hadn't been tampered with anyway. So you'd just have to make a leap of faith, and assume it was "secure"? If you were prepared to do that, then fine use the yubikeys. If not, perhaps you should take a deeper look at your usb mouse and keyboard too. Did you verify that your keyboard isn't running some code that might compromise your security?