From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human interaction so it's not susceptible to social engineering or phishing attacks. Also, it connects with the service provider using encryption so it protects against man-in-the middle-attacks. Is my understanding correct so far?
I can still think of several benefits that Authenticator Apps have over USB keys.
- Most people already have a smartphone so there's no additional cost or burden
- If lost or stolen, phones can be remotely tracked, locked and wiped.
- Phones can be encrypted or at least have a lock screen
- The Authenticator App can be password protected
- Backup codes for OTP can be used, whereas it seems much more of a problem if a USB with keys is lost.
Given these facts I find it hard to see why people use things like USB keys?