Shneier on 2-factor authentication failures

http://www.schneier.com/blog/archives/2005/03/the_failure_of.html