I am sick of the actual motions of authenticating, and many of the 2-factor implementations out there today are terrible. (SMS, really? What happens when your p

I am sick of the actual motions of authenticating, and many of the 2-factor implementations out there today are terrible. (SMS, really? What happens when your phone is stolen? How do you protect against an angry lover? What a joke) U2F dongles aren't much better. Also, a quick glance at that link seems to indicate attacker needs some sort of MITM access? Is it anything more than a replay attack?