U2F has the advantage that a server compromise won't compromise the second factor as there's no shared secret accessible to both parties. Of course, keeping th

U2F has the advantage that a server compromise won't compromise the second factor as there's no shared secret accessible to both parties. Of course, keeping the token on the same machine that you're using for logging in is reducing the security, but then, the token is stored in the Keychain and once you're at the point where malware is so deeply hooked into the system that it has access to the system Keychain, then it can also inject itself into your browser and get a 2FA token whenever you log in.