Comment by adam-p

Except that TOTP codes are MitM phishable. U2F with its URL-checking (via browser cooperation) is needed.