Is 2FA software token solution stronger than hardware tokens? What are their strengths and weaknesses in comparison?
The window of opportunity for a thief to use a mobile phone is substantially less than for a soft token (you realize your phone is gone long before you miss your token). In addition, there are optional features of software tokens that do not exist on hardware tokens, such as the software token application can warn the user if the challenge code is coming from a fake website, and the software token application communicates transaction specific information to the user on their mobile phone, therefore the user knows exactly what is being authorized.
