A normal Yubikey is still vulnerable to MITM and phishing attacks. The combination of a password (using a password manager) and a U2F key is more secure (Yubic

A normal Yubikey is still vulnerable to MITM and phishing attacks. The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key. Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.