mastahyeti

Which device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.

From my testing of several hardware U2F implementations, the test-of-user-presence (touching the button) unlocks the device for an amount of time. During this time multiple authentication/registration will succeed without further user interaction. Even without this behavior though, hardware tokens don't indicate which site your authenticating with. Malware could just make an authentication request right as some user action triggers a legitimate authentication request.

It is :-)

You still have to configure TOTP (SMS or App) 2FA before you can add a U2F device. That might change in the future.

My understanding is that the FF softtoken was intended to be temporary while they worked on their HID support. That might not be the case any longer though.

I think the greatest practical threat to TOTP is phishing. U2F, regardless of where keys are stored, binds a keypair to an origin. Only authentication requests from `github.com` can use the `github.com` keys. For my money, any U2F implementation is a win over any TOTP.

There is a known bug where leading whitespace can cause the key to not be parsed. Also, check that you're only trying to upload a single key, and not your entire keyring.

It shouldn't be necessary to push a new signed commit for old ones to start showing the "verified" badge. We do cache some of our templates though, so it may take a while for some pages to be updated.

GitHub Desktop doesn't support commit/tag signing at this point. Sorry.