Well, they have recently added a bunch of weirdness to the spec. At one point U2F was simple - a USB token with a hardwired user presence button, providing a s

Well, they have recently added a bunch of weirdness to the spec. At one point U2F was simple - a USB token with a hardwired user presence button, providing a second factor alongside a username and password. Trivial to move between different computers and OSes. Secure even if the host OS can't be trusted. Physically unpluggable. These days there's a mad variety of options. Options that are only secure if the host OS can be trusted. TPM-based options that are tied to a single laptop. Options like Windows Hello that are locked to a single OS vendor. Passwordless login, turning two factors into one. Copying credentials between devices, through the cloud. Sketchy low-cost biometric scanners. For a security system, the latest versions sure are embracing a lot of complexity.