Webkit's webauthn support is in development [0]. Hopefully the adoption will improve a lot once all major browsers support it.

[0]: https://bugs.webkit.org/show_bug.cgi?id=181943

What's the user story for mobile browsers? Other than having a key hanging off an OTG adapter, how can we secure a login made over a phone or tablet?

WebAuthn can use the TPM chip in smartphones. It works the same as a discrete hardware WebAuthn token: the key material is generated on the chip, and never leaves it. The smartphone OS can't access the key on the TPM either, only use it cryptographically to prove possession of the key.

You can test it right now with any recent Android smartphone with TPM chip:

https://webauthn.io/

Apple will eventually join the club too once they stop dragging their feet.

Of course with the TPM you effectively have a hardware token permantently physically linked to your smartphone, so it changes the security analysis a bit.

For users this means that WebAuthn for accessing websites on a TPM-capable smartphone is really just a matter of unlocking the device when prompted. Quite user friendly.

There are NFC capable yubikeys, but I think in general the Secure Enclave of the phone itself is used to store auth creds.

WebAuthn can't get here soon enough. I am really really looking forward to it.

OTOH, an advantage of TOTP is that it can be used without plugging in stuff, so it works on machines that don't let you access the USB ports, or that don't have them at all.

Is Solo better than Yubikey in any way?

Edit: looks like solo has a USB-C + NFC option that seems to be missing from Yubikey's selection.

Edit 2: Same with Feitian which also only has USB-A for the NFC product...