> The whole thing seems to be a bit of security theater too, because the YubiKey is not keyed to my biometrics, so anyone in physical possession could touch the

> The whole thing seems to be a bit of security theater too, because the YubiKey is not keyed to my biometrics, so anyone in physical possession could touch the button to authenticate. This is clearly misunderstanding the point of a hardware security key. If I can reduce the number of people that can hack you to the people who can access a single, uncloneable, physical object, is that not greatly increasing your security? It is the "Something you have" part of security.