[Andre607]

> We need u2f

U2F is not immune to phishing attacks, at least not if backup codes are being used: https://youtu.be/rPTI9e-9tBE?t=936

[thefounder]

Then let's not use backup codes. If you loose your auth device then you should recover it using an office of authentication (i.e https://travel.state.gov/content/travel/en/legal/travel-lega...)