I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that he was good as social engineering. What made him good was that he took the easiest way in, which is kind of what my point is. I don’t care if you block the hardest hack - I care about blocking the easiest.

(FWIW, I am a huge fan of 2FA, I just don’t understand how it stops phishing.)

The way U2F prevents phishing is by binding auth requests to the requesting origin and generating unique key pairs for each origin, so it doesn't matter if the user is convinced and manually activates the key, the phishing site gains nothing it can use on a different origin—even in real time.

My entire argument was "with U2F, this is the easiest hack, and it is very hard."

What do you think the easier alternative was?