Ever worry that malware might be silently spying on you, like logging your keystrokes to steal passwords?

You are not alone. Many of us have turned to security gadgets like YubiKeys for extra protection, but even those aren't foolproof.

Here is the catch: if malware gets onto your system, it can wait for you to log in, then trick your YubiKey into authenticating a session for the hacker. All it takes is a well-timed fake prompt or just waiting until you touch the key. In this case, the YubiKey is simply doing what it is told - no smarter than a card reader.

This problem isn't new. Back in the 1980s, smart cards with built-in screens and keypads were designed to help users see what they were actually approving. But those never caught on mainly because of the cost and complexity.

Instead, the tech world took a detour: smartphones became the "good enough" second factor for most of us.

But here's the rub: unless your authentication device shows what exactly you are authorizing - on its own secure screen - it can't fully protect you. Hackers can and do trick users into confirming bad transactions using misleading interfaces, often making their fakes look more user-friendly than the real thing.

A recent example? Hackers stole $1.4 billion by tricking employees into confirming a malicious blockchain transaction. Even though the hardware wallets used had screens, they displayed raw technical data - stuff only a developer might understand. The attackers showed a nicer-looking (but fake) screen instead, and boom, funds gone.

This highlights a deeper issue: UI (User Interface) designs matter in security. But UI has lost its way. Once a thoughtful discipline, it's now often reduced to mere visual flair - "UX Skins" that look cool but fail to help users make good decisions.

So what's the answer?

• Devices like YubiKeys could evolve to include screen displays that show what you are approving.
• We need a better UI design that balances clarity with flexibility.
• And maybe most importantly, we need to teach people how not to get tricked online, just like we used to teach people to avoid scams in the real world.

Because at the end of the day, no security system is better than the decisions it asks real people to make.