I mean, you say all this, but more or less these are the same complaints I hear from even seasoned IT professionals every single day when it comes to security.
Even the "the key is in my coat" is not a joke at all -- I've had clients who got compromised by a malicious insider because some admin wrote passwords on a sticky note simply because "password managers are cumbersome".
I get what you're saying on each point, but understand that security is as much about discipline as the actual security you implement. You can have the best of the best, but it doesn't mean anything without the discipline to use it, and I suppose that's what the author is trying to convey.
You even touch on it in your response about developing the right habits, and that's the author's port -- without discipline, the Yubikey means nothing.
>Again, this is not a Yubikey's problem. It's a website problem.
On this point I can't really agree at all; Yubikey might have a solid solution for a problem, but if no one is implementing it, then it's a solution looking for a problem. The mythical "average user" won't be persuaded to drop any amount of money on a dongle that does nothing; if it doesn't work for a large majority of their most common sites, then it's just a waste of money.
I'd suggest it __is__ Yubikey's problem as they're not promoting their value to sites in a way that implementation is a no-brainer. Checking on their compatibility list fo common chat-applications, common forums, common message boards/imageboards, and common shops world-wide, the adoption is very limited. Surely the admins of popular sites are aware of Yubikey, but at some point there was a decision not to add functionality -- Yubikey needs to make the efforts to promote adoption and figure out where there resistance comes from.
Of my daily sites that I might expect to be aware of/implement some hardware security, only reddit is on the list of "works with Yubikey", and I pretty rarely use reddit. Listing sites my friends and family use on a day to day basis, only Google Accounts comes up.
That's what the post is talking about. Yubikey does not have the penetration to be viable to "average users", and even for tech persons, the device is useless without the discipline to adjust habits in the first place, which most people just don't have.