> Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol. This could also be do

> Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol. This could also be done using client side TLS certificates without restricting the application protocol used on top of the TCP connection.