> Hardware tokens without the ability to disable SMS / email is quite useless. I agree. On a desktop it's possible to bypass the hardware token and use the SMS

> Hardware tokens without the ability to disable SMS / email is quite useless. I agree. On a desktop it's possible to bypass the hardware token and use the SMS which cannot be disabled AFAIU. > And I cannot do yubikey on the iPhone. it MUST be sms / call. Huh, did not know that. Not even the nfc version works?