It might be air gapped, but knowing the quality of electronics in those days, I would guess a C64 is not immune to data exfiltration via EM radiation through the air or through the power supply or via the keyboard. :-)
The RF encoder + cable acted as a transmitter.
We were granted a guided tour one night of a facility at the top of a skyscraper in San Diego. It was shrouded in mystery and government TLA programs. My boss was explaining parts of it to me.
He said this is a TEMPEST secure facility. I'd never heard the term but when he described the principle to me it made a lot of sense. My father is a radio buff and raised me to learn all about electromagnetic stuff. The facility had conditioned power lines and shielded walls and partitions that could block EMR effectively to keep computing information safe from prying eyes.
There were other fascinating Top Secret features of the facility that were explained to me that night. Of course the facility was not in operation and unmanned at the time of our unclassified tour. I was gobsmacked at the depth of real bona fide security measures and countermeasures, even in those primitive times.
This is unrelated to "Van Eck Phreaking"
Everyone has a webauthn capable device, if not multiple, right now.
The only reason phishing is still a thing is because people keep implementing and defending phishable 2FA methods.
(Personally, I'll be waiting until 1Password gets WebAuthn support before moving to it from TOTP.)
1Password is a centralized and proprietary database system that leaks all secrets to system memory every time you use one. Why would you want that to manage webauthn secrets for you? You just tap your webauthn device when prompted. No third party control required.
https://rationalwiki.org/wiki/Not_as_bad_as
TOTP is phishable and the secrets to unlimited codes live in plaintext on both the client and the server. Endpoint malware, phishing, and database dumps are some of the biggest threats online and TOTP offers no strong defense to any of these. In some ways TOTP is even worse than SMS as it is possible to manipulate timestamps to get a code valid in the future. SMS and TOTP both are garbage in terms of both security and UX. Their use should be discontinued ASAP.
Webauthn solves for these problems, and everyone has devices that support it already. It is negligent at this point for web service providers to not mandate webauthn and discontinue both SMS and TOTP.
Webauthn has a number of severe usability downsides that will conspire to hamper its adoption outside of use cases where people are literally forced to use it.
1. The keys cannot be backed up. Nobody is going to accept being locked out of their online accounts if they lose a physical key.
2. Nobody wants to mess with a physical key when logging in anyways. At least TOTP can live in my password manager.
3. The options for not having physical keys are platform specific, tie you to a platform providers account for backup, and turn an operating system reset or a new smart phone or badly applied ban or account lockout from an annoyance to a possibly catastrophic loss of functionality.
None of these are problems in the enterprise because they have simple workarounds. For the rest of us? Yuck. I will gladly keep my platform independent, easy to back up, widely ubiquitous standard with the trade-off of looking at the URL bar when logging in and not clicking links in emails.
To your points:
1. Multiple devices such as Ledger support FIDO key backups in the form of transcribing simple english words to paper. Most services support multiple webauthn devices registered at once though which is simpler for most people. You can also as a last resort offer a user with a one-time-use 2FA reset code just like TOTP sites do if you wish. Lots of options.
2. Your laptop and phone already have built in webauthn authenticators if you have a device made in the last several years.
3. See #1 for backup options
The default paths for TOTP recommended to most like Google Authenticator do not have a backup solution either. Users will have to research alternative TOTP solutions that support backups just like Webauthn, so that situation is no worse.
Webauthn is as good or better in UX and better in every way in security. People had to learn to use TOTP, which is complicated. People capable of using TOTP are technical enough to register two webauthn devices like a phone and a yubikey, or a phone and a laptop, or failing all else a phone and a paper backup.