The fancier Yubikeys have multiple functions - not just the basic U2F.

One function is 'PIV' - acting as a 'smart card'. When you create or load a key, you can choose whether you want to require a button press or not [1]. They strongly recommend requiring a button press.

No physical button press = an attacker with root can sign things at will.

[1] https://docs.yubico.com/yesdk/users-manual/application-piv/p...

It's not realistic for the attacker to trick you into keep pressing the button so it's not a real threat anyway.

If you choose to not require touch for your Yubikey it's user error

Yubikeys work great if used as designed.

This appears to be using the PIV "smartcard" applet.

I believe one option on each certificate in the PIV applet is whether or not a "button press" is required for its use. I believe it is recommended that the device attestation certificate at least is not guarded by the button press.

The threat model for yubikeys is to prevent the key being cloned - if it's in your pocket, it's safe. If you plug it in, and authenticate by PIN to the PIV applet, and push the button when prompted, someone may be able to generate a signature.

I was thinking the same thing. I guess you would need some sort of XSS to get the user to touch the key. I've seen the web dialogues on Beef and they can be quite convincing, but still doubt this will work with any significant sample of victim/users.

Presumably you would trick the person into touching the key. Similar to getting someone to put their password in with a phishing attack.