Can a file e.g. containing some random key that is generated by my web site/app be acceptable as the second factor (the first factor being a normal password) in 2FA?
Someone said so to me in the past, but i doubt about it, because i think a key in a file is not very different from a password in that it is stored on the hard drive and can possibly be read and copied by adversaries.
I don't know much about hardware security tokens (e.g. USB dongles), but seems to me they can atleast be protected against copying/cloning via ordinary and easy means.