For instance you cannot be tricked to press the key and authenticate with a “fake” web page since authentication origin is also part of the process and the communication between the device and the web browser cannot be intercepted by a third party.