Is a device I used previously an a website an additional authentication factor? I would imagine yes, but the device somehow has to send something to the server to prove that it was previously logged in to my account. Is this not just another secret, something someone else could know, like the private part of a private/public key pair?
From the specification of U2F v1.2 Sec. 8:
The counter is a strong signal of cloning but cannot detect cloning in every case - for example, if the clone is only one which is used after the cloning operation and the original is never used, this case cannot be detected.
Is it necessary to implement such an anti-forgery-mechanism for a device to be considered an authentication factor? Where is the line between 2-step-verification and 2-factor-authentication? Does TOTP count as an authentication factor, even though the TOTP-secret can be known from multiple devices?