Yubikeys are intended to block phishing. This attack requires physical access.

IE: If you're "worth it" to target IRL, you shouldn't use a Yubikey to begin with. Someone can swap your spare and you won't realize it until too late.

5.4.3 5C Nano here.

> L. So, Yubico is providing _free_ replacements, right?

Nope, mitigations. :(

https://support.yubico.com/hc/en-us/articles/15705749884444-...

The last time Infineon chips had a crypto-breaking bug, Estonians got new ID cards for free. Meanwhile my less than two months old Yubikey 4 stopped working as a hardware attested PIV smartcard.

> Meanwhile my less than two months old Yubikey 4 stopped working as a hardware attested PIV smartcard.

As in that the hardware broke? Or software stopped supporting it?

Software that keeps revocation lists (or whatever they are called) up to date stopped accepting keys generated on that hardware. The Yubikey itself continued to work just fine, but I had to switch to externally generated keys.

Unless the software is maintained by yubico I don't think its fair to say that the key "stopped working".