While these data do not directly yield a password, an attacker can use a dictionary or brute force attack to operate on the challenge until a matching response is computed. CryptoCard's model requires the user to enter a challenge into the card. This challenge is encrypted, then sent as the response. In both of these cases, the response, if captured, cannot be replayed or used to guess the password. Smartcards can be used for authentication as well.
Hardware tokens that generate OTPs seem like a great idea.
The answer comes down to money. Additional costs include replacing lost tokens, administering and updating the authentication server's database, and purchasing and maintaining the authentication server itself. For these reasons, token-based authentication has not been widely adopted, even though it's much more secure than the use of passwords. Several different methods have been developed for doing just this.