As attackers find ways around authenticator apps, hardware two-factor authentication makes a lot of sense
"Phishing and credential stuffing attacks are two of the biggest threats to any large organization, but two-factor authentication (2FA) - especially hardware 2FA - is remarkably effective in mitigating such attacks by an order of magnitude or more.
A low- to moderately resourced attacker who successfully phishes an employee and steals their account credentials is going nowhere fast if that employee has hardware 2FA enrolled. Authentication will still require physical possession of the hardware 2FA token. Likewise, in cases of password re-use where an attacker tries a credential stuffing attack, that hardware 2FA token will come in mighty handy at fending off a huge chunk of the background attack noise of the internet...."
Read More ...