Quote Originally Posted by 'Vyndree',index.php?page=Thread&postID=187964#post 187964
The problem is that actual programs can be reverse engineered to figure out the algorithm of the phone-authenticator. Let's hope they use a seperate algorithm for the physical authenticator and the phone version.

Granted, given enough data anything can be reverse engineered. I just don't like making it easier to do.
It would still be seeded in some fashion, which would require not only knowing the method used to create the number, but the seed as well. This of course is possible if they malware your phone and somehow manage to tie it back to your computer that you play wow on and keylog that machine as well. Of course, I could see this being an issue for any device that actually connects tot he computer to sync - but for phones that don't ever get connected directly to the PC the odds of this happening are very slim at best.

I agree it's not as secure as a physical device, but it's far more than adequate for the seperation of account from physical token for me.