Question: I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option.

Option "hardware token":
Authentication into the web platform is done via username/password but transactions are performed via a combination of PIN and a onetime hardware token key.

Option "fingerprint":
Authentication into the web platform is also done via username/password but transactions are performed by authenticating into a software token app on the phone via a fingerprint and getting a onetime token key.

My understanding is that the hardware token option is more secure because phones and laptops nowadays can easily be infected with keylogging and other kinds of software to eavesdrop on my passwords. However, the fingerprint authentication is a biometric form of authentication and as far as I know can only be spoofed with a physical fingerprint and not software, thus possibly providing the same level of security.

Another weak point could possibly be the risk of stealing the software token's seed.

What do you think I should choose? Is hardware token still the way to go or is biometric identification a sane alternative in my scenario?

Answer: 
The fingerprint doesn't directly protect the token (it can't - we to date have no reliable way to consistently scan a fingerprint). The OS encrypts the token with your credentials. An API call into the OS allows applications to request the token which forces the user to re-authenticate.

So the risks on the mobile application come down to -

* How much do you trust the operating system on your device?
* (Related to above) How much do you trust the sand-boxing on the device to stop applications reading each others memory space.
* How much do you trust the application not to place the token anywhere accessible to other applications.
* How much do you trust the fingerprinting mechanisms to stop the phone/app being cloned (Personally I would view this as close to zero).

You also need to counteract this against how high is the risk? I.e. were the app mass exploitable would the bank cover losses? And are you a high risk target (for example a billionaire probably has a higher attack risk than average Joe).

For the vast majority of users I would argue the app when paired with a strong unique password should be viewed as secure enough. Were the app to be compromised the bank would likely take the hit and refund clients.

A hardware token in theory should be more secure - its effectively an airgapped system. For a private/public key system the private key never has to leave the device. However there have been historical issues with manufacturers design decisions and implementations.
For this multi-factor authentication I would choose the fingerprint option, for the ease of use (you don't have a thing that you might misplace). This is assuming that as the bank is offering both they believe them to both provide adequate security and would provide insurance for a successful attack on either. I don't think a biometric finger scanner app is as secure as a hardware token, as there exists online attacks if the mobile is compromised for example. The hardware token would have to be physically stolen from you for any attack that I am aware of (as another answer pointed out it should provide an air gap between the internet and the secret it contains).

Also with the fingerprint option you still have the chance of [this](https://www.theregister.co.uk/2005/04/04/fingerprint_merc_chop/) happening. It's an old story but it still gives me chills.