If you have malware on your system it will just take your post-login cookies and you are already hosed. A software WebAuthn solution stops the most common thre

If you have malware on your system it will just take your post-login cookies and you are already hosed. A software WebAuthn solution stops the most common threat that TOTP misses: phishing. Even software WebAuthn is better security than TOTP in every way, especially if it takes the QubesOS approach of running it in a dedicated offline VM.