The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin.
But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass:
But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass:
- https://www.yubico.com/support/issue-rating-system/security-...
- https://www.wired.com/story/chrome-yubikey-phishing-webusb/