Credentials to VPN can be obtained as well. I assume that's what happened in the twitter hack? Surely they must not have not allowed that tool to be used withou

Credentials to VPN can be obtained as well. I assume that's what happened in the twitter hack? Surely they must not have not allowed that tool to be used without being connected to their VPN. Hardware keys probably would work. But can a key be used on different computers? If yes, then the method I have highlighted would be more secure (and cheaper). If not, then both would have the same level of security.