Hacker News Reader

Or by using a U2F device, which is designed to prevent spoofing.

U2F doesn't protect you from an untrusted machine, it protects you from untrusted websites.

The security model relies on the browser validating the origin.

I don't think there is a way around "displaying that purpose on the trusted 2FA device." if you want to protect against a compromised computer.

Domain binding protects you from fishing, but still relies on the user's computer, including the browser, being secure. So it doesn't help here.