They're both flawed, since they are easy to replicate and impossible to replace once the attacker has your credentials.