I freely admit that hardware tokens may be more secure, but the more 2FA that uses the standard implemented by Google Authenticator the happier I am. Plus, in my mind it would be cheaper and easier to implement a software only process than to try and convince a CFO that buying, shipping and managing little pieces of hardware will have sufficient ROI.

I also am not holding my breath for even the software 2FA since quite a few of my financial institutions won't even let me use punctuation in my password. Yes, the irony of implementing 2FA lowering the risk of a simple password isn't lost in me.