[bluGill]

Which is great until someone who might or might not really be "Karen from HR" says they lost their Yubikey and needs a new one. This workflow must exist, but it is generally easy for an attacker to get authenticated by that system.

[loeg]

That is a significantly higher barrier than phishing.

[bluGill]

often The point of fishing is to get enough info to fool that sywtem.