Actually if your PC is compromised, then bad guy can exploit even hardware Yubi, because Yubikey lacks any screen, only button. Adversary can intercept your lo

Actually if your PC is compromised, then bad guy can exploit even hardware Yubi, because Yubikey lacks any screen, only button. Adversary can intercept your login in MITM style, authorize themselves on other machine, just using your machine as proxy, and website you tried to login to would just display error "can't authenticate, try again". And thangs to fact that key lacks display, attacker can event authenticate to different site, than you are authenticating now. Trezor is way better device here: > Phishing protection with on-screen verification. Trezor always displays the URL of the website the user wants to log in to, and what exactly is going to be authorized; therefore it is possible to verify that what was sent to the device is what is expected. https://wiki.trezor.io/U2F https://wiki.trezor.io/U2F https://wiki.trezor.io/FIDO2 https://wiki.trezor.io/FIDO2 And it supports U2F and FIDO2 (FIDO2 requires more expensive, newer model). P.S. storing locally in TPM is bit more secure, but still exploitable in case of local privileged code execution.