GitLab 10.0 Released

With U2F, the browser talks directly with the USB token - so neither you nor the the site implementing U2F authentication will ever have direct access to the key used to authenticate you. While with TOTP/HOTP "mode" is based on a shared key between user and server which is easily accessible at least when configuring it.

For U2F to function, the browser needs to support it. Google Chrome/Chromium supports it out-of-the-box, while with Firefox this add-on[1] works most of the time (not with Atlassian's login for some reaon)

[1] https://addons.mozilla.org/en-GB/firefox/addon/u2f-suppor...

More details on U2F can be found here:
https://developers.yubico.com/U2F/