Comment by frei

U2F doesn't protect you from an untrusted machine, it protects you from untrusted websites.

https://security.stackexchange.com/questions/157756/mitm-att...

The security model relies on the browser validating the origin.