> 2. U2F/Webauthn key as second factor is phishing-proof. TOTP is not.
TOTP doesn't need to be phishing-proof if you use a password manager integrated with the browser, though.
TOTP doesn't need to be phishing-proof if you use a password manager integrated with the browser, though.
If certain websites fail to be detected, thats a security issue on those specific websites, as I'll learn which ones tend to fail.
If they rarely fail to detect in general, its infrequent enough to be diligent in those specific cases. In my experience with password managers, they rarely fail to detect fields. If anything, they over detect fields.