Construct a phishing site that gives some vague error message about being unable to connect to your device, and offer the TOTP fallback. How many people will fa

Construct a phishing site that gives some vague error message about being unable to connect to your device, and offer the TOTP fallback. How many people will fall for it? "Literally cannot get phished" is woefully far away, because the phishing-resistant property of U2F has a giant hole in the side of it (fallback factors) and therefore still relies on human vigilance. I do use U2F though, because it is pretty convenient.