Comment by occams_chainsaw

Even if you phish their password to a site, the person can't log in because they also need the physical key. The key doesn't validate anything related to the domain AFAIK