Well physical presence is huge - your software-compromised token can sign infinite number of bogus token requests, where as with hardware, you'd have to be an i

Well physical presence is huge - your software-compromised token can sign infinite number of bogus token requests, where as with hardware, you'd have to be an idiot to press the button for random requests, or repeatedly; and has nothing to do with stolen passwords. The best an attacker can do at that point is access whatever account-specific token that was 'intercepted', and use that until it expires on whatever site...which if implemented correctly won't let you make any major changes without your token press - aka, software-token just gave up your account, where hardware would have stopped it.