After following [the instructions here][1], which suggested I use [`ykpers`][2] or the [gui version][3], I discovered the Mt. Gox Yubikey is protected by a "configuration protection access code."

From [the manual][4]:

> **Protection of the key and configuration data**
> 
> Given the symmetric nature of the AES encryption algorithm, the
> security of the Yubikey relies that the AES key is logically and
> physically protected both in the key and in the server that verifies
> the OTP.
> 
> The configuration data is updated via a configuration API, accessible
> via the USB interface. To prevent unauthorized update, the
> configuration can be protected by a 48-bit access code. If used, an
> exhaustive search of all combinations would typically take some
> 100,000 years to perform. Furthermore, the Yubikey configuration data
> is write-only, i.e. configuration data and the key can only be written
> but not be read. This means that unauthorized update of the
> configuration is an act of sabotage rather than a security threat.
> 
> The configuration data is stored in a non-volatile storage integral to
> the microcontroller. A potential attack is to physically probe the
> silicon or analyze the hardware behavior to potentially gain full or
> partial knowledge of the stored secrets. However, such an attack would
> require a complete break-up of the Yubikey, involving dissolving the
> microcontroller chip encapsulation. Furthermore, very advanced
> equipment is needed to probe the chip internals. Given the effort and
> costs involved for such an attack, this is not considered a threat
> given that just a single device will be broken.

Yubikey wrote me:
> In case, if you have forgotten the configuration protection code or do
> not find it in the log file, then you can not reconfigure the YubiKey
> slot again. This functionality is implemented to strengthen the
> security.

Also, he wrote:
> In the context of [the manual][5], an "unauthorized update of the
> configuration" would be changing the configuration settings on an
> unprotected YubiKey. Since you already have an access code in place,
> you cannot preform such an update.

**But it should still be possible to "sabotage" a Mt. Gox Yubikey, no? If not, why? If so, how?**

What is also strange is that when I try to create an account at [forum.yubico.com][6] or test my Yubikey at [demo.yubico.com][7], they reject my OTP. Yubico Forum's registration says my OTP can't contain non alphanumeric characters, and it sometimes contains periods.

thanks

  [1]: http://forum.yubico.com/files/VIPunlockGuide.pdf
  [2]: http://yubico.github.io/yubikey-personalization/
  [3]: http://yubico.github.io/yubikey-personalization-gui/
  [4]: http://static.yubico.com/var/uploads/pdfs/YubiKey_manual-2.2.pdf
  [5]: http://static.yubico.com/var/uploads/pdfs/YubiKey_manual-2.2.pdf
  [6]: http://forum.yubico.com
  [7]: http://demo.yubico.com