>But because the User Presence detection happens in the physical authenticator it can't fake that, it does need you to press the button, tap the sensor or whate

>But because the User Presence detection happens in the physical authenticator it can't fake that, it does need you to press the button, tap the sensor or whatever. Sure, there's a user present. That doesn't stop the account being compromised. Users tap that thing all day when prompted. You prompt, they tap, easy as pie. If you're really advanced you could build a little mechanical arm that would reach out of the computer and tap the key itself. >And the credentials obtained this way are inherently one-use That "one-use" could be to add a new 2FA device that's under the attacker's permanent control.