Codes from those apps are typically TOTP: a deterministic output given a shared secret (e.g. from QR-code during the setup procedure) and current time interval,

Codes from those apps are typically TOTP: a deterministic output given a shared secret (e.g. from QR-code during the setup procedure) and current time interval, e.g. HMAC(shared-secret, time-interval) mod 10^6. This does not embed the domain. However, U2F is a completely different protocol that does: you'd typically insert a YubiKey in a USB port and tap a button on it when the browser sends "plz sign a request from login.bank.com" (+ other associated data) https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview.... (Note that most YubiKeys also support non-U2F modes, most commonly HOTP (HMAC(shared-secret, counter); counter +=1))