I phished for your login credentials, and I get them, but there is no way for me to effectively use them because there is still the hardware key step, which I do not have.

Malware downloads is a separate issue from phishing schemes.

Right, and even if they completely root an employee's laptop and phone they still can't get into the hardware key. Sure, they can "boop hijack" the key by popping up a convincing fake login prompt, but they have to synchronize their schedule to the employee they want to hijack and pull off a convincing fake login prompt each and every time they want to login, so the logistics are still much more challenging than copying a OTP seed.

Why go thru all that trouble when you can just phish with malware?

I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that he was good as social engineering. What made him good was that he took the easiest way in, which is kind of what my point is. I don’t care if you block the hardest hack - I care about blocking the easiest.

(FWIW, I am a huge fan of 2FA, I just don’t understand how it stops phishing.)

You're moving the goalposts. GP was just explaining why base level phishing has been elevated to a higher difficulty level than without U2F.

The way U2F prevents phishing is by binding auth requests to the requesting origin and generating unique key pairs for each origin, so it doesn't matter if the user is convinced and manually activates the key, the phishing site gains nothing it can use on a different origin—even in real time.

Thank you. Indeed I was missing that - your last sentence in particular.

> I don’t care if you block the hardest hack - I care about blocking the easiest.

My entire argument was "with U2F, this is the easiest hack, and it is very hard."

What do you think the easier alternative was?

The word "phishing" has many definitions.

One definition is tricking users into giving valuable information (such as passwords, 2FA codes, bank account details, credit card numbers, social security numbers, etc). Malware doesn't meet this definition of phishing.