On QubesOS, a Linux distro, a virtual FIDO device is being implemented along with a domain whitelist firewall. Github also made a proof of concept software FIDO

On QubesOS, a Linux distro, a virtual FIDO device is being implemented along with a domain whitelist firewall. Github also made a proof of concept software FIDO token in the form of a browser plugin s few years ago. Chromium also has built in virtual webauthn support in devtools and other examples like this already exist: https://github.com/bodik/soft-webauthn https://github.com/bodik/soft-webauthn The goal of 2FA is not to stop malware, as malware on your machine will just take the post login cookies and do whatever. The point of 2FA is to protect a user from phishing or database leaks, and TOTP fundamentally fails at stopping both. You can also change system time and get a valid token in the future, and anyone with read access to your phones or the servers system memory can get unlimited free codes by dumping the plaintext secret. Any service still offering TOTP is frankly negligent. WebAuthn is the only standard phishing resistant 2FA available and even pure software emulated solutions offer dramatically better protection than TOTP.