Sure, that's a valid question. 1. YubiKey's OATH application can be protected with a password. If you can't unlock the YubiKey with a password, you can't acces

Sure, that's a valid question. 1. YubiKey's OATH application can be protected with a password. If you can't unlock the YubiKey with a password, you can't access any OTPs (or "OTPs" in exile, where they're being used as HMAC keys instead). (Granted, exile does not directly integrate with this yet, nor even mention it - thanks to you, I'll add it to the readme ASAP) 2. The YubiKey is an HSM, which means it can't be duplicated. As soon as you find your laptop/keychain stolen (which is much easier than detecting that the contents of your home directory have been copied) you can revoke the AWS API keys. 3. I consider a hack and theft of my home directory contents to be more likely than physical theft of my YubiKey (which I believe for most people is either permanently inserted into their laptop, or on a physical keychain). This risk calculus may be different for you. 4. As you point out, the attacker would need to know how to make use of this (as yet) fairly obscure use of the YubiKey.