U2F is touted as a new 2 factor authentication standard that has built in defense against phishing attacks. As I understand it, this works by registering the device with each service, thereby creating a unique keypair. If a phishing site pretends to be someone, they will fail that cryptographic check and the key fob won't activate
But as I understand it, the phishing site may still be able to steal the user password. Nothing prevents the user from inadvertently entering their password on a malicious site (even though the single password is not enough to crack the account). Is that correct?