Explain why a six-digit TOTP code can be captured by phishing, whereas a FIDO2 key cannot. Base your answer on what the user transmits in each case and on the role of the domain.
