I agree with you on the advantages of U2F/WebAuthn, but the rest of your comment seems pretty oblivious to the usability challenges of TOTP MFA. The security ri

I agree with you on the advantages of U2F/WebAuthn, but the rest of your comment seems pretty oblivious to the usability challenges of TOTP MFA. The security risks that you cite are remote and orthogonal to the security risks of not having MFA in the first place. Trying to shame users into obeying the finer details of the TOTP RFC won't work. Let's just nudge people over to U2F instead.