Browser side certificates only work in the browsers you install them in; the average computer user will need tech support to help them copy a key/cert pair to a

Browser side certificates only work in the browsers you install them in; the average computer user will need tech support to help them copy a key/cert pair to a new browser. The key is also probably not encrypted on disk (by default). Emailing a login token to a user every time they want to log in requires that their email is working and that they can get to their email, and would slow down the login process. It would waste everyone's time. I think it only makes sense as an additional authentication measure for high security applications where logging in at a moment's notice is not a necessity. Yubikey is okay for one or two sites if you have one[1]. They cost money, and serve no purpose other than improving security of logins. Compare to a smartphone running a TOTP app. Most people already have a handheld device, and a TOTP app and setup for a website is a free one-time install with one-time setup and no ongoing overhead. It also doesn't require working email or even working internet, which doesn't matter in the typical case but matters a lot in edge cases. Email might be down. SMS might be down. You might not have cell coverage at all. [1] Yubikey only has two slots, and so you can't store unique OATH seeds for more than two sites, right? How many yubikeys do you expect people to carry around? How many sites even implement HOTP rather than TOTP? If every site implementing 2FA implemented challenge/response for yubikey, then yubikey would be great. However, TOTP is the dominant form of 2FA, and that limits the usefulness of yubikey.