Read a much more detailed security review of the Yubikey as it works in practice here:

http://www.unrest.ca/yubico-reinvents-the-yubikey