Indeed, we used those RSA SecurID key fobs for VPN login in some places, and people would just "forget" them in the laptop bag. At a certain point, the user be

Indeed, we used those RSA SecurID key fobs for VPN login in some places, and people would just "forget" them in the laptop bag. At a certain point, the user behavior IDS constraints become more important than building a deeper moat. 2FA cellphone based anything is $23 away from some adversaries control... ultimately more security theater in my opinion YMMV =3