The key thing this solves is the guaranteed delivery of credentials to a worker, wherever they may be. You will also likely take more care of your phone than you would a token. |
There are literally tens of thousands of publicly accessible applications, from internet banking, government applications, and healthcare, that are simple to exploit because developers are either using default [password] settings, or relying on pre-packaged scripts available on the web. |