Not quite. A 6 digit code can be phished out from users pretty easily. They'll enter it anywhere its asked, similar to a password. However the U2F and Fido spe

Not quite. A 6 digit code can be phished out from users pretty easily. They'll enter it anywhere its asked, similar to a password. However the U2F and Fido spec requires a Cryptographic assertion (with all that replay attack mitigation stuff like Nonces) that makes it so that an attacker can reuse a Token touch. I'd probably encourage a glance over this https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fido-u2f-overview-ps-20141009.html https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fid... Sadly the Wikipedia article doesn't have a good layman's explanation yet, but I'm sure it'll will soon. Yes at a high level, its still 2FA but like most options in any factor of Auth. It can be improved upon. (For a simple case, take Fingerprint readers and look at the advances of liveliness checks and how many unique points it requires.)