Exactly. Until we can come up with a better system the rule of thumb is: 1) Know something 2) Have something Its somewhat easy for a potential cracker to gai

Exactly. Until we can come up with a better system the rule of thumb is: 1) Know something 2) Have something Its somewhat easy for a potential cracker to gain access to either one of the two, but extremely difficult to have both. Hell, when I used SecurID at one of my first jobs you had a PIN to go with the token number, almost like a salt to your password. Even if they had the key they wouldn't be able to access my accounts.