This is an interesting piece of kit, though I’m curious who the target market really is? Frankly I would be more comfortable regularly rotating my hardware security key’s password than I would be manually keying in my 2nd factors pin every time I need to use FIDO2 or TOTP. This would almost appear to be an excessive amount of security for me as an infosec professional which honestly makes me suspect it’s targeted towards a paranoid audience. Not that this wouldn’t have it’s applications. As a backup security key to be stored in a secure location this is definitely intriguing, but I can’t imagine using it on a daily basis.
Respectfully I think this is a minimal attack vector in this case due to the limited character set of urls. But thanks for the callout, I didn’t know there was a name for this sort of attack.