Comment by digianarchist

> And the U2F/FIDO part is very interesting as it eliminates phishing as a risk.

How does that work? Can't the challenge response be MITM?