I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone with my yubikey would be able to access my Google account.
I've used yubikey for SSH login and I have to put the PIN. Why for Google login it does not ask me? Is there a way?
Is there a way to also make its OTP generation depend on a PIN?
I tried putting a PIN on FIDO2, but I still can log into Google without any PIN, I don't know what's that for