Good list, but I think it actually understates the advantage of security keys over other methods of 2FA. It's not just that they're physical objects, it's the p

Good list, but I think it actually understates the advantage of security keys over other methods of 2FA. It's not just that they're physical objects, it's the protocol (either FIDO U2F or FIDO2/Webauthn) is fundamentally resistant to phishing attacks. Take the author's example of accidentally logging into accounts.google.com.evil instead of accounts.google.com: If you and/or your password manager are tricked and enter your username and password, all other 2FA methods are vulnerable to an active pishing attack where the attacker site relays the login information to the real site in real time. You enter your TOTP code or hit "yes" on a push notification or whatever, the real site logs you in and passes your session cookie to the attacker and you're hacked. With a security key when you log in the browser tells the key what website you're connecting to and about its TLS certificate. If the security key wasn't registered with it exactly, it won't work. It's almost impossible* to get phished if you use a security key as your 2FA method. * There are few ways. If you're phished during first time setup of the security key, or if the attacker gets a valid TLS cert for their website and impersonates accounts.google.com with a network level attack, or if they manage to get a trusted private CA onto your machine and do the same, or if they can exploit a 0day in the browser or the key to disrupt that communication and lie to the security key about the site's identity. But the bar for these forms of attacks is significantly higher.