TOTP is also vulnerable to good phishing attackes. You can convince someone to enter their creds and OTP code, which can be used remotely. The value of the Yub

TOTP is also vulnerable to good phishing attackes. You can convince someone to enter their creds and OTP code, which can be used remotely. The value of the Yubi is that you need it physically, which can't be accomplished via phishing and other remote attacks. Physical theft is much, much rarer, and if a laptop with Yubi in it is stolen the thief won't have your user/pass (unless it's on a sticky in your bag, etc). It's a very, very targeted attack if they phish your creds, then come steal your laptop, and you need more advanced protections than a yubi.