> Yubikey would indeed prevent an attack like this from working. It would using U2F / WebAuthn. Some Yubikeys support generating TOTP codes [0], which would be

> Yubikey would indeed prevent an attack like this from working. It would using U2F / WebAuthn. Some Yubikeys support generating TOTP codes [0], which would be vulnerable to phishing attacks [0] https://support.yubico.com/hc/en-us/articles/360013789259-Using-Your-YubiKey-with-Authenticator-Codes https://support.yubico.com/hc/en-us/articles/360013789259-Us...