One thing to consider is the possibility of your phone itself being compromised (stagefright et al.). Note how Duo issued a security advisory to limit access fo

One thing to consider is the possibility of your phone itself being compromised (stagefright et al.). Note how Duo issued a security advisory to limit access for Android devices [1]. A fully isolated component like a Yubikey has a smaller attack surface area for these kinds of things (easier to audit smaller code, no sustained Internet or cellular connectivity). [1]https://www.duosecurity.com/blog/understanding-your-exposure-to-stagefright-vulnerabilities https://www.duosecurity.com/blog/understanding-your-exposure...