In theory a yubikey is safer than simply logging into a website using passwords when the device is untrusted. A USB device like a yubikey could provide an untr

In theory a yubikey is safer than simply logging into a website using passwords when the device is untrusted. A USB device like a yubikey could provide an untrusted (or even trusted) devices with only a temporary access token. The untrusted device can only manipulate a user session with the user present, once the user has left, the session expires and the computer has no access token. WebAuth makes it impossible to continue or begin a session without being authorized to do so if a USB device is used. TOTP is one implementation of a "trusted device authorizes untrusted device" protocol that Yubikey/WebAuth/others enable. Compare with password logins: Once you enter your password you trust the device you entered it on to not compromise it.