A company I worked with has what seems to me to be a bit of an odd security policy, for working remotely all people need to connect through a corporate VPN to reach the internal networks. The process though is slightly different for contractors and regular employees. Contractors need to use a number generated from an RSA SecurID physical device given to them when they join. Full time employees don't have hard tokens and instead use a company internal piece of software that runs locally on their laptops to get the number. I was wondering if anyone could give a summary of why a company would chose a to use a physical device vs software for the two factor auth.

  • The software that runs on the laptop to get the number - are they also RSA token numbers? Do you have to enter credentials to get the token or do you just access the program and you get a token?
    – katrix
    Commented Jan 20, 2017 at 15:24
  • Not sure if they where token numbers, my recollection is a bit fuzzy. There was no authentication on the program other than logging into the password protected and hard-disk encrypted laptop.
    – mercurial
    Commented Jan 20, 2017 at 16:01

2 Answers 2


That is a common usage. The interesting part in a physical device, is that when you no longer work with a contractor, you ask him to give you back the device and you are sure that he will no longer be able to connect to your system.

Employees are assumed to be more reliable, so a software way is enough. The security is no longer on the physical way (it is easier to copy a software that a physical device), but on a legal way. I mean that the company can fire and/or prosecute an employee that would not respect the security policies. That is just a compromise between the risk and the way to mitigate the risk


It looks like full-time employees, being better vetted (since a large portion of the vetting is usually up to the vendor for contractors) are given a "more convenient" way to access the VPN, since the tokens are generated on the laptop. Contractors would need one more "something you have" factor (of 2 factor auth fame) to access the VPN. If physical vs (properly implemented) soft tokens had any security implication, the less secure one would have never left the ground IMO.

  • Sot tokens are of course more unsecure than hardware tokens. Just because a product exist, does not mean the product is good, sensible or healthy. Softtokens are for complaining non-technicals, who do not understand the concept of 2FA. This is why they left the ground. Because it makes the users feel good. Not because they are safe.
    – cornelinux
    Commented Feb 1, 2017 at 17:37
  • Inherent flaws and implementation flaws are two very different things. Could you elaborate more on why you don't consider a soft token a second factor? If implementation is your pain point, then a badly designed physical token from Acme Corp would be insecure too, right?
    – katrix
    Commented Feb 1, 2017 at 20:11
  • In an ideal world a second factor is a piece of possession. The idea behind the possession is, that the attacker needs a different skill set to attack this second factor. This is what makes it harder for the attacker to attack. Otherwise you could use a second password as a second factor ;) One important feature of a possession is that the owner realizes, when he does not possess it anymore. It can be stolen, but it should not be copyable.
    – cornelinux
    Commented Feb 2, 2017 at 10:09
  • ...A piece of software with a cryptographic key in a file (be it encrypted or not) can be stolen by the attacker with the same skillset and without the owner knowing. The attacker will have all the time to retrieve the plaintext secret key and thus have a copy of the possession factor. Bottom line: same skillset and copyable. (But of course the world is not simply black and white)
    – cornelinux
    Commented Feb 2, 2017 at 10:10
  • I understand what you're saying, but again - isn't that an implementation issue? Copying a secret key from a laptop is no different from stealing someone's physical fob. The crucial point is this - the password is something you know, the key is something you have. That makes the key the second factor.
    – katrix
    Commented Feb 3, 2017 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .