I have worked with systems that use it to authenticate machine to machine communication (e.g. a web backend authenticating itself to another service doing work for it). In that environment it works well.

Using it to authenticate a person regardless of device doesn't work so well from a usability point of view.