[kop316]

https://developers.yubico.com/U2F/Protocol_details/Overview....

Via the U2F protocol, the browser embeds the URL and optionally the TLS Channel ID in the challenge, so a phishing website asking for a challenge will produce the wrong challenge (and response).

Note this does not prevent an attack via webUSB (https://www.wired.com/story/chrome-yubikey-phishing-webusb/ ).

[setheron]

There's no we ay to stop a full MITM though where maybe the State took over the certificate of a site.

[dfox]

If the Channel ID is included it stops MITM completely.

In fact doing the authentication inside the secure channel in a way that depends on the key that is used by such channel is the best way to perform mutual authentication. In MitM case the authentication will just fail and passive attackers cannot learn anything about the identities used for authentication.

Both SSH2 and many Windows-related protocols work in exactly this way.