Just throwing in a argument against hardware keys like Yubikey compared to SMS: Phones are good in that that their owners depend on them and will notice that th

Just throwing in a argument against hardware keys like Yubikey compared to SMS: Phones are good in that that their owners depend on them and will notice that their phone is missing in a relatively short period of time. Whereas lots of people will have no qualms lending out a hardware token indefinitely in order to help a colleague. It might not tip the balance all the way back so that hardware tokens end up being worse for security - it just goes to show that security is complicated.