If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes.<p>That can&#x27;t happen to a properly designed physical token, and even though it can happen to a phone token, it&#x27;s <i>less likely</i> to happen, because (at least in the iOS case) your phone is hardened much, much more severely than your OS X kernel.