Thank you, that was a most interesting read.<p>This is my way of dealing with these issues:<p><pre><code>  - use a unix box rather than a windows machine to conduct online transactions, 
   reducing the chance of having malware on the system

  - never use an the authorization token from someone else, just my own, which 
    I treat roughly the same as any other valuable

  - get a new one directly from the bank once every year to avoid wearing down 
    the keypad so the pin numbers stand out

  - always type in the url of the bank in full and verify that 
    again when authorizing transactions

  - check the list of outstanding transactions that I'm authorizing 
    to make sure the amount and beneficiaries match
</code></pre>
The things this still leaves me vulnerable to are man in the middle attacks impersonating the bank website, at a minimum this would require poisoning the DNS of the provider, another trick would be to install a keylogger, but this would only get the attacker a bunch of one-time codes (which could presumably be used to recover the pin in combination with the challenges).<p>And of course nobody can rule out a brutal attack on my person to get possession of the PIN code, and I expect that such attacks will increase in frequency.