Hacker News Reader

I second a usb authenticator. It's also an effective defence against phishing attacks - unlike OTPs.

How does it work against phishing attacks? Does the browser pass the domain to the USB authenticator?