[rahkiin]

Exactly! And I use 1Password so I also have the tokens on my computer, together with my passwords. Replay attacks get harder though.

[justinlardinois]

I think his point was that if your password is stored on your phone, two factor authentication doesn't actually add any security because it's no longer two factor.