Surprisingly I don't see this question on ServerFault already. I'm wondering about the pros and cons of hardware token vs software token for two-factor authentication - only in the context of security, not convenience. I am referring only to the time-based one-time password generators.
Is there a clear winner in terms of security? Does it vary according to the platform the software token (app) is installed on?