Say I have two websites with 2FA mechanisms that are otherwise identical.
You have to enter a PIN into your Token Generator in order to retrieve your One Time Password. On the website, you then use your password and the OTP by itself to login.
On the other, the OTP is accessible just by physically having the device. On the website you enter your password and then [PIN] + OTP.
I wondered if there was a provable difference in the security provided by these two methods? Are they equal and is it purely a design choice, or are there further considerations to make?
For example, it's clear to me that in Mechanism 2 it's at least possible to have the PIN intercepted electronically. After which, an attacker would just need temporary access to your Token Generator to login. But then, if the attacker is physically local they could probably gain your PIN some other way (CCTV, shoulder surfing etc)