they come with slot 1 configured with a yubikey-OTP with the credential (public ID, private ID, and aes key) registered on the yubicloud. You can test to see if its still programmed that way by opening a text editor (or anywhere you can type text) and tapping the yubikey with a short tap. It will print out a OTP and <enter>. If slot 1 is still factory fresh, the first 6 characters will be c's (cccccc) and the next 6 characters are the device's serial number in modhex format. c is modhex for 0. If you copy the first 12 chars (or just the 7-12) into the modhex converter page on yubico.com it will convert to the serial number of the device.
You can never know what that aes key and private ID are so if you reprogram slot 1, you can never get it back to that state where it works with the factory aes key (crendentials). But you can program a new aes key for yubikey-OTP in slot one and then upload/register that key in the yubicloud.
So it should always be safe to program slot 2 with anything. If slot 2 is programmed, the push behaivior changes slightly. To push slot 1 you do a short tap and to push slot 2 you do a long tap.
--BobGStatistics: Posted by bobjunga — Fri Jun 05, 2015 10:48 pm
]]>