passwords are a flawed solution
They have been through history and way before the industrialized world, not only that but what was considered secure yesterday may be compromised today or tomorrow. This is not going away any time soon and you have to design security taking this into account.
Another problem with password, it's that those web services we use password for collect way too much sensitive information that they should not be given in the first place.
seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only leaves you vulnerable to people who have physical access to the USB device, and even then i can imagine simple ways to make even that a hassle (have another password layer as master sign-in? would be enough to deter most of your acquaintances from being able to use your device)
The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key.
Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.
Correct analysis,
> recommend password managers
No! Passwords should never be considered as secure material, period. Centralizing in a password manager centralizes the burden. There are half a dozen other workable solutions, among which authentication by email (What else is the reset-by-email link?), Mozilla Persona and all kinds of asymetric keys.
So does using a single email account for everything.
Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized information and biometrics (TouchID and such) makes them all the more secure.
Moreover, this is the only solution that's capable of dealing with all the asinine password requirements that get imposed on users...solutions like this card fail hard when the password requirements prohibit certain characters and/or other characteristics of these passwords (repeated characters, length, etc.) Until the world gets together and standardizes what constitutes a secure password, memorized passwords will always be a flawed solution.