3 ms·Except that TOTP codes are MitM phishable. U2F with its URL-checking (via browser cooperation) is needed.by adam-p 2y agoExcept that TOTP codes are MitM phishable. U2F with its URL-checking (via browser cooperation) is needed.