4 ms·SMS and TOTP (Google Authenticator) can both be phished. U2F cannot be phished.by Buge 9y agoSMS and TOTP (Google Authenticator) can both be phished. U2F cannot be phished.TeMPOraL 9y agoCan't it? What if I control the user's computer and can let my own code interact with U2F? Or does the protocol somehow prevent that?deleted 9y ago[deleted]Buge 9y agoIf you control the user's computer, that isn't phishing. That's keylogging/credential theft.