2 factors - something you know and something you have. The device is what you have, the pin is something you know, otherwise anyone can pick up your security key and use it

It adds another factor (something you know), which increases the difficulty of an exploit.

Since Microsoft's implementation of FIDO2 is passwordless, you NEED to use a PIN, which is the "something you know" part, the key being "something you have".

And if the PIN is complex enough, bruteforcing or guessing won't work as I believe the default behavior is to wipe the secure element storage after 8 incorrect attempts (with 3 attempts per key being initialized at a time).

Those bruteforce protections aren't really worth a lot in practice. If you have physical access to the device, you will eventually be able to find a way to glitch it - as things like Cellebrite have already proven for the iPhone.

Is there any demonstrated case where someone was able to exfiltrate secrets from a Yubikey secure element?

Because Microsoft's implementation is incredibly boneheaded, and doesn't allow the Google-style mechanism of username+password+Yubikey. They only support U2F/Webauthn as an alternative to a password.

I assume Microsoft is hoping to make Windows the main Webauthn provider out there, to tie online identities into the Windows login process for easier tracking/advertising.

Also - thanks to that FIDO2 does not seem to be usable with Microsoft's MS365 services [ Teams, Outlook, Excel etc ] on Android or iOS. there's no way to provide pin for the security key, regardless if it's plugged in via the USB port or used via NFC.

https://learn.microsoft.com/en-us/azure/active-directory/aut...

bummer