Domain Matching 2FA (opens in new tab)

This is a valid approach, but it might lead to a more complicated setup compared to the alternative approach shown in the article (example.com/5678).

Yes, it is. This system is primarily meant to counter phishing attacks that use similar domains. I should have clarified that in the post.

That's a really good post, interesting read. This is similar in some ways but I don't see how their approach protects the user from more advanced attacks (an attacker could still swap the captcha).

If you enter google.com in your browser and login, unless you misspelled the domain and that didn't get flagged by anything, you'll be fine. If a relative that doesn't know much about tech gets a text/email asking them to login to their bank but the site linked is b4nk0f4m3r1c4.com, that phishing site could replay the entered credentials into the real site to login.

Not quite readable on mobile.

U2F would be a much superior replacement for any idea in which the user has to enter anything at all. It’s better to have the security hardware, such as a U2F key, authenticate the authenticator using cryptography, because that process cannot be man-in-the-middle’d.

I agree that U2F/webauthn/FIDO2 is superior (in terms of security and in most cases convenience) in basically every way. This is an alternative approach that is less secure than webauthn but a bit more secure than regular number matching or enter this code 2fa.