My main problem with dongles is that most of the companies that implement them don't even invest the time of what they charge for one dongle in securing their application. They take some code snippet, toss it in the application's init, and think they're golden
Most of my youth was spent programming, and a big portion of that was spent in reverse engineering various protection schemes. Dongles can be a very secure method, but most protections could be cracked within 5-10 minutes with a proper breakpoint and change of an opcode. One of the more complex ones I spent 7 hours on basically creating a fake dongle responder (used DLL injection to divert all the Dongle's queries to my code and respond back with appropriate answers).
I remember reading through the HASP4 programmers manuals to learn everything about it. You could actually store some memory on the dongle, that means you could store either an encryption key, or a segment of code, and prevent your application from running in its entirety unless that dongle was there, requiring at least one cracker to have bought the product to reverse engineer it. I never got to see this implemented myself though, only programmers just doing stupid checks.
I believe SAI/Flexi's got the right mentality about moving to cloud/web based verification. While nothing is ever bulletproof, it at least makes one not so furious at a protection scheme that you just want to see it defeated
