Domain displayed is no real protection, actually its weakness is what drives phishing. But the link you provided contains some interesting info: > How SQRL cha

Domain displayed is no real protection, actually its weakness is what drives phishing. But the link you provided contains some interesting info: > How SQRL changes things > When using SQRL, users do not identify and authenticate themselves with a username and password. Instead, their unique user identity is derived from their secret master key and the website's full domain name. So that's similar to what U2F does - domain name (origin) is part of the protocol.