Can someone ELI5 why Yubikeys are better for 2FA than using, say, 1Password, which simplifies the process with cmd + \ and automatically pasting the 2F code? (Even better than Google Authenticator; no need to reach for anything.)
Yubikeys in U2F mode are better than any OTP because they protect you against phishing attacks. 1Password auto-filling arguably has this property too, but you should disable that sort of password manager behavior:
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...
Not really. The TOTP RFC recommends accepting TOTP tokens from before and after the current time step to make TOTP work with clock drift. Since most implementations use time steps of 30 seconds an allow TOTP codes of at least one past and one future time step, the window in which an TOTP code can be used is typically 90 seconds.
Consequently, TOTP only works against 'offline phishing' where a phisher collects data first and tries to take over the accounts later. For any kind of immediate phising, there is typically no problem to forward re-use the token, even with a small delay.
As you say, U2F protects against this, by using challenge-reponse and using the origin selecting the key handle.
Thanks. I certainly understand that but the convenience trumps the risk imo. Further, I don't want to reach for and insert a USB drive every time I want to log in somewhere. And what if there's no available USB port?
The only thing that would be more convenient would be if the browser authenticated itself using a client side TLS certificate as one factor in the authentication process.