I've been doing some reading about YubiKey (for example What is a Yubi key and how does it work?) and found the information to be incomplete. It's my understanding, that when the user is prompted to answer a password, all they have to do is plug the YubiKey into a USB port and press its button and then it automatically types out a password into the active text field.
According to Linux Journal
Each time you press the button on the device, it generates a one-time password and sends it to the host machine as if you had entered it on a keyboard.
So if it's a different password each time what good does that do?
Is it any more secure than using any USB key with a key file on it?
From Yubico it's not possible to backup the device so if you lose it or break it you're in trouble (in this sense a regular key file is much better).
I've read that it's not susceptible to malware copying the key, but I don't believe this. If it acts like a keyboard, what's stopping a keylogger from intercepting the keystrokes?
Yubikey is open source. Does it matter since it's primarily a hardware device?
If it does just enter a password, how is this different than just having another password written down or memorized?