The FIDO/Google blog post about it: https://fidoalliance.org/case-study-series-google-security-keys-work/ https://fidoalliance.org/case-study-series-google-sec

The FIDO/Google blog post about it: https://fidoalliance.org/case-study-series-google-security-keys-work/ https://fidoalliance.org/case-study-series-google-security-k... And the actual study: http://fc16.ifca.ai/preproceedings/25_Lang.pdf http://fc16.ifca.ai/preproceedings/25_Lang.pdf (Which helps answer some of the arguments in the discussion thus far. In particular, on page 11, they list the systems they compare against: SMS OTP, Google phone-based OTP, and three hardware tokens, including the FIDO U2F. They compare in Figure 6 explicitly with SMS OTP and app-based OTP.)