OTPs suffer from being phished. If you accidentally log in to a phishing site, you would still type in an OTP when prompted, which the phishing site can pass al

OTPs suffer from being phished. If you accidentally log in to a phishing site, you would still type in an OTP when prompted, which the phishing site can pass along. While this does only give one time access, that can still do a huge amount of damage. Solutions like U2F create credentials that are specific to the site you are currently on, enforced by the software. So the credential sent to www.goeglo.com isn't valid for www.google.com, and so foils phishing much more completely.