[microtonal]

A YubiKey under the doormat protects against one of primary intended scenario: preventing phishing. It's unlikely that a phisher on the other side of the world has access to your doormat. Moreover:

- Modern FIDO2 keys allow you to set a password (I think sites have to implement the newer FIDO2/Webauthn standards rather than U2F to use this functionality). So then when someone takes it from under your doormat, it is worthless.

- Passkeys are coming. E.g. on Apple platforms they will be secured between devices using end-to-end encryption (through iCloud keychain) and they use biometric authentication to unlock (Face ID or Touch ID). This will make non-password authentication a lot more convenient.

[winternett]

I know, I've used them multiple times.

The thing is, no one can explain to me how it's better than just requiring 2+ passwords on each user account. You can't authenticate if you lose the Yubi when tech support is not available without circumventing the very process it was based upon... Nothing is failproof. Of course each specific use case is different.

If Facebook demanded I use a dongle or even biometrics, that would very well be the exact point I quit it though.

[ziddoap]

>The thing is, no one can explain to me how it's better than just requiring 2+ passwords on each user account.

Really? It seems pretty straightforward. In one case I have a physical object that must be physically stolen from me to access my account. In the other case, if I make 2 poor passwords, my account can be accessed from anywhere in the world, no physical access required. The pool of people who can realistically compromise my account drops exponentially.

>You can't authenticate if you lose the Yubi when tech support is not available without circumventing the very process it was based upon.

Perfect is the enemy of good. Some people sometimes losing their Yubi and having to authenticate in a different way one time is not a good reason to argue for not having them at all.

[fragmede]

U2F ("Yubi") doesn't have a "password" that's exposed to the user (you), so the attacker would have to steal it in order to get its password. Meanwhile, two passwords are basically the same as having one long password, and if the attacker gets that, then they're in.

(Yes, if the attacker can factor very large prime numbers, then they can get the "Yubi password", but if they can do that, there's a lot of bitcoin they could steal.)

U2F also signs the auth with the site's domain name, so even if the user tries to log into faceb00k.com (zeros), U2F won't let the attacker reuse the credentials on facebook.com.

This does require that you actually lose access without the second factor. In higher security environments this is enforced - if you lose the U2F device, then you can't log in. Obviously if the site lets you log in without the device then having the device doesn't actually matter.

Lost device flow is a weakness, but typically they're more involved and require the attacker to have more details about the user than a simple phish attack would have access to.

[staticassertion]

> The thing is, no one can explain to me how it's better than just requiring 2+ passwords

I'm sure many people can explain this. It's not hard. FIDO2 tokens are not phishable, the domain name is part of the challenge.