Comment by mr_mitm

> And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password.

That's why I qualified it with "certificate-based". The private key never leaves the device, ideally a yubikey-type device.