This is one of nice things about using a hardware security key (FIDO U2F), like Yubikey. Since the security key works with the browser to ensure its communicat

This is one of nice things about using a hardware security key (FIDO U2F), like Yubikey. Since the security key works with the browser to ensure its communicating directly with a specific site, you can't MITM them like you can mobile app (TOTP) or SMS-based two-factor codes. I wish more browsers would add support for them.