On: TOTP tokens on my wrist with the smartest dumb watch

[jgrahamc]

Phishing doesn't require stealing the watch. It just requires me to type in a TOTP token on a phishing website. Very different threat model than physical access.