I don't think good hygiene is achievable in practice – some phishing websites are extremely deceiving. I wouldn't bet on myself, a technically capable professi

I don't think good hygiene is achievable in practice – some phishing websites are extremely deceiving. I wouldn't bet on myself, a technically capable professional, being able to distinguish some of them, especially in a planned attack: for example when trying to login to a dashboard after being woken up by a page middle of the night, I might not notice a homograph attack. TOTP is better than SMS, both are better than second factor, but it's a great idea to mandate U2F/Webauthn if you can.