[JamesSwift]

How does that password scheme even work unless the plaintext pin is being stored somewhere?

[LordDragonfang]

The system knows how long a yubikey string is and can easily discard that part before hashing.