I (along with a billion or so other people) was notified about my Yahoo! account being potentially compromised yesterday. While I'm not worried about that (I have changed my password since then, have a very long and complex password, and don't reuse it), they did take the time to point out the Yahoo Account Key feature. This is a feature where, when you login, it sends a notification to the Yahoo! app on your mobile phone, and you must approve that before the login can continue.
You'll no longer need to remember complicated passwords when you use Yahoo Account Key to access your account. To sign in, tap "Yes" on the notification we send to your mobile phone. With Account Key enabled, there's no password on your account, so no one other than you can sign in.
This seems similar to the Google TFA option, Google Prompt, which is certainly better than just single-factor authentication. But the difference here is that while Google requires the password AND the prompt, Yahoo does not require the password: so this is single-factor authentication, just a different factor.
How secure is this, compared to a good, complex, long, never reused password? Are there any known methods to subvert mobile phone notifications that could affect something like this?
I have an iOS device, running stock iOS, but welcome answers that include details about phone-side risks for other phones/situations (though would like my scenario covered, preferably). I also have my Yahoo! account connected to my Google account (which is protected with 2FA, using Google Prompt), and back my phone up to iCloud. I have a 6-digit passcode and fingerprint authentication on that. I'm not particularly worried about a targeted attack (I have no particular reason to fear one, not knowing anyone who is sufficiently skilled to do something like this nor having enough valuable information or money to be worth targeting); this is primarily about attacks that are general in nature.
I'm not concerned about understanding the difference in how these work; I have a good understanding of both. I'm focusing here on trying to compare the risks; while I have a good understanding of passwords and the risks inherent in 1FA with passwords, I don't have a good sense of the risks inherent in 1FA with mobile notifications, and how to balance the two.