> What can an average person do better than remember one strong password? Use as 2FA a physical U2F device which is itself protect by an HSM and a PIN and eras

> What can an average person do better than remember one strong password? Use as 2FA a physical U2F device which is itself protect by an HSM and a PIN and erases itself after 3 failed attempts (which, granted, comes with its own problem if you lose it / forget your PIN / have it stolen). It's kinda a big fraud that Yubikeys have been "sold" as the be-all / end-all of 2FA when they are, themselves, not protected by a PIN (for costs reasons and costs reasons alone: there's no way on earth a pinless Yubikey is better than a U2F device protected by a HSM+PIN, but that costs way more to build). And here you'll get the ultimate argument: "you have to understand the threat model" / "this is not the threat model a Yubikey defends you again" etc. Oh really? Then why then do we have now Yubikey protected by fingerprints? The threat model changed or what?