[tuananh]

i dont get why it's better password and 2FA? leaving yubikey unattended, it will only require attacker to know the password (PIN).