This is correct, which is why I am a big fan of FIDO U2F software like https://Krypt.co https://Krypt.co . This requires your phone which is essentially a secon

This is correct, which is why I am a big fan of FIDO U2F software like https://Krypt.co https://Krypt.co . This requires your phone which is essentially a second workstation to authenticate. So now you need to exploit two workstations.