I've heard that hardware keys like Yubikey are phishing resistant. But I do not understand where a phished man-in-the-middle attack, which tries to "forward" the whole communication, fails in that scenario.
I'm imagining the attacker opens a live connection to the target site and forwards every little bit of information to the victim while displaying a fake website. That fake website would somehow need to certify to the victim's browser as the real one by forwarding that communication, too. Eventually the victim is asked to press his hardware key button and the attacker forwards every communication again.
So if you are a skilled hacker who has full control over the internet communication, at which step is the hacker unable to play a transparent man-in-the-middle?
I could imagine the answer is that either the communication must be encrypted up to the victim and the hacker cannot decrypt, or the hacker sets up an unencrypted end, but is unable to re-encrypt it while the user's browser is asking for encryption. But not sure how to make sense of it.
(What are the names of phishing resistant methods of hardware keys? Webauthn, challenge-response, ...?)
I do refer to the U2F mode only and I suggest that the attacker tries to certify as the real domain by "forwarding communication" - if that is possible.