>This essentially turns "something you know" into "something you have" It really doesn't. This essence of "something you have" is that you really, truly must h

>This essentially turns "something you know" into "something you have" It really doesn't. This essence of "something you have" is that you really, truly must have it for authentication to work -- every time. In this case, if you capture the data on the Yubikey once you never need to have the Yubikey again (since he's using the static slot). Or to flip it around, if you just once leave your Yubikey in your pocket in coat check, or in a checked airline bag, or in your USB slot when you go to a meeting, etc., it is potentially 100% compromised without your ever knowing. This is why true "something you have" systems like Google Authenticator, or the actual Yubikey system as it was designed, use constantly changing keys.