One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they wouldn't be able to use this information, since the nature of one-time passwords prevent their reuse. However, if an attacker is able to observe the keypresses in real time, there is always going to be a small period of time between when the digits from the token are typed in, and when the "Enter" button is pressed. An attack tool can be easily scripted to take advantage of this lag to authenticate on behalf of the attacker.
I know that yubikeys submit "Enter" as part of the string of characters they send, but how to solve this for RSA and Google Authenticator tokens? Is there a solution?