>security is as much about discipline as the actual security you implement Totally agree on that. The author's main ranting about Yubikey is that it requires d

>security is as much about discipline as the actual security you implement Totally agree on that. The author's main ranting about Yubikey is that it requires developing new habits, but that's exactly the point. >they're not promoting their value to sites in a way that implementation is a no-brainer. That's a good point. Although, poor adoption of hardware tokens even by banks (e.g. no bank in Canada supports Yubikey) is surely not because it's hard to implement. It's a "chicken-or-egg" problem. Organizations don't support hardware tokens because few people use them, and few people use tokens because many organizations don't support them anyway. Yubikey and other hardware token vendors could've done a better job promoting and simplifying using hardware tokens.