Maybe the only answer is to air-gap the two devices and have the user input a secret code shown on the dongle. So you press the button, type the code on the website and log in that way.<p>Edit: Or maybe have two devices: one dumb flash storage and a device that actually computes your key. You press the &quot;compute my key&quot; button while the storage is connected to the keychain, then disconnect it from the keychain and connect it to the pc. Next time you connect it to the keychain, it&#x27;s wiped before use and never ever read.