Keep in mind that you're usually expected to enter the OTP generated by the RSA token into the same web browser that sees your password. It just makes it so the

Keep in mind that you're usually expected to enter the OTP generated by the RSA token into the same web browser that sees your password. It just makes it so the attacker has to exploit the stolen credentials right away, instead of storing them for later use. I think there's some value in that though.