Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an occasion where:
More than one multifactor device (token) would be issued to a single human (or user account)
In a ASP scenario, (or service like Amazon Web Services) when would more than one token be registered?
The key difference I'm illustrating above is corporate controlled vs web service like banking, IAAS, SAAS, etc
- Should users be allowed a "backup" token if they lose or forget their primary token? How many tokens should they be offered?
This last point would also be valid where a YubiKey Nano (or similar) is installed on a Work and Home PC. This user may also have a travel token as well. The concept is that the threat footprint is reduced (albeit not "perfect")