My point is still that these devices (yubikeys) have <i>always</i> been black boxes. Nothing has really changed.<p>Yes, I prefer open and Free systems. I don&#x27;t like running on Intel chips, because they come with a back door monitoring chip that&#x27;s hard to keep track of, especially on systems with an integrated network card. Yes, it&#x27;s nice to have the PCB, hw design and code of a device whose purpose it is to &quot;do crypto&quot;.<p>But I still don&#x27;t see how things <i>changed</i> wrt. yubikey here. They have always been upfront about selling magic crypto beans so to speak: either you trust them, or you don&#x27;t. There&#x27;s no real transparency. There&#x27;s not even (AFAIK) an easy way to know you have an actual yubikey device, and not a device that just looks like a yubikey[1] - but in fact contains different, or modified hw that does a little more than you would like. And so is the case with keyboards <i>on which you enter your secret communication</i> (as well as passwords and pass-phrases).<p>This isn&#x27;t new, it&#x27;s been yubikey&#x27;s business model to be a company you trust to &quot;do crypto&quot;. I still think it is much more likely that a yubikey isn&#x27;t compromised than the rest of your system. And I think it does buy you some security. I&#x27;d even go so far as to say I probably trust a small proprietary system by experts, more than the behemoth that&#x27;s the jvm&#x2F;jdk&#x2F;javacard.<p>I&#x27;ll also note, that it is probably easier to spot a yubikey &quot;read abitary files from my system and then call home&quot;, than it is to spot a yubikey answering to a secret 40-digit number and disclose all session keys it&#x27;s generated up to that point, along with any private keys stored on the system. Which is the kind of thing you&#x27;d probably not want it to do, when handled by Egyptian secret police, or whomever it is you&#x27;ve pissed off.<p>[1] <a href="https:&#x2F;&#x2F;www.yahoo.com&#x2F;news&#x2F;report-nsa-intercepts-computer-deliveries-160237344--finance.html" rel="nofollow">https:&#x2F;&#x2F;www.yahoo.com&#x2F;news&#x2F;report-nsa-intercepts-computer-de...</a>