> Is there a solution for the fact that all of your accounts will be secured by the same "source"? 2FA is still an option (e.g. 1 thing that you have + 1 thing

> Is there a solution for the fact that all of your accounts will be secured by the same "source"? 2FA is still an option (e.g. 1 thing that you have + 1 thing that you know), with the hardware token representing a more secure alternative to phone SMS messages. > Isn't this almost close to using the same password on every site? To get the a shared password, you have to hack one of hundreds of different services that password is used on, or phish the user, and penetration often goes undetected for years. To get the physical secret, you have to rob the user, who will notice they've been robbed the next time they attempt to login. Additionally, trying to login to a phishing website won't automatically auth them with the real website - I can't do secure key exchange algorithms in my head, but a hardware device can.