Not just phishing attacks. Compared to TOTP, U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens authentication against s

Not just phishing attacks. Compared to TOTP, U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens authentication against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which even given the vulnerability described here still has a tiny fraction of the attack surface of a TOTP app and its general purpose host device.