I think password + security tokens is a more common way to go nowadays, when you need to access externally.