I have answers/arguments along those lines here: https://github.com/lrvick/security-token-docs/blob/master/FA...
Would be interested in seeing contrasting views though!
Would be interested in seeing contrasting views though!
The real answer for "why not a smartphone app" is "because code generators are just as phishable as passwords". In the real world, that's how people are being compromised, not by elaborate phone exploit pivots but by phishing pages. It also speaks to why phone authenticators are acceptable backups to tokens.
The real answer for "why not SMS" is "because both teenagers and intelligence services can get a phone number redirected; your phone number is not your phone."
Obviously, you don't PIN-lock a U2F token; the answer to "what if it's stolen" is "whoever stole it probably doesn't have your password, which they'll need in order to use the token, so if your token is stolen remove it from your account and then fish $17.99 out of your couch cushions and buy a new one".
No matter how much you protect the secret though, not getting phished is left to the hopefully paranoid user, which is for sure not ideal, but we are probably years out from TOTP being replaced with U2F for most sites.
TOTP via hardware tokens is a stopgap.
Great comments though. Will update to reflect them.
The idea behind the U2F/TOTP stack is to minimize your exposure to phishing attacks and at the same time minimize (to practically zero) the odds of you being locked out of your account. It accomplishes that nicely, which is why most of the other experts we talk to have U2F/TOTP/backup-codes as their Google 2FA stack.