Here's the hard thing about security: the more authentication factors you have, the more secure things are... but in practice, people won't use too many factors, because they want ease of use. There's clearly a tension between security and usability, not to mention between security and privacy (good security doesn't always come with great privacy -- what if you're a journalist or dissenter under a repressive regime??). And finally, there's a tension between the convenience and inconvenience of hardware given the expected convenience (but also dangerous connectivity) of software and mobile everywhere.