To add to what jsnell said, the Yubikey requires a tap. A physical interaction from someone sitting at a laptop, which is something a trojan cannot accomplish,

To add to what jsnell said, the Yubikey requires a tap. A physical interaction from someone sitting at a laptop, which is something a trojan cannot accomplish, and a tiny barrier from the human that doesn't materially contribute to fatigue. Now, I don't really know how much of a difference it makes for trojans, since presumably the resulting token/cookie/etc. could just be compromised in place. One might hope is scoped or at least of a more limited lifetime, I suppose. (Compromise by trojan is one of those "all roads seem to end in pwned" events to me.) I will note that it at least requires some authentication to happen prior to compromise, so if some IDS is blaring off alarm bells, all hope might not be lost if the device can be cut off fast enough. (The point here, though, vs. MS Authenticator, is that Authenticator adds nothing but massive amounts of friction over the supposed Yubikey state of affairs. Edit: although, see another of my comments: apparently MS Authenticator's behavior is configurable — for uh, some reason —_so I've switched it to "less annoying" mode. So, I'll forgive MS a touch, but AIUI it's the default to fatigue the user…)