On 9/6/22 17:29, Alex Perez wrote:
Jonathan,
Your perspective on costs seems extremely developed-country-centric, and
I'd like to suggest you check your (financial) privilege. I don't know
where you're from; I'm from the US, but I am well aware of the reality
of many open source contributors from countries where the exchange rate
against the US dollar is awful.
You may not see this sort of cost as a barrier to contribution, but I
can assure you that other casual contributors may, and likely would. You
have to realize that the cost of the token isn't necessarily the only
factor that contributes to the overall cost of obtaining such a device.
International shipping costs can easily triple this dollar amount, to
say nothing of other associated costs such as import duties, etc. There
are plenty of countries where such tokens are not domestically
available, and must be shipped from abroad.
This just isn't as simple or straightforward as you seem to want it to
be. Erecting financial barriers to contribution is dangerous, and has
unintended consequences.
Yes, this stinks.
Unfortunately, there are no good alternatives I am aware of. The
closest I can think of is some form of software FIDO2 implementation.
Qubes OS will hopefully have one eventually, but I am not sure
if it will be usable outside of Qubes OS and maybe SpectrumOS.
Another option is a TPM-based authenticator. Would this be acceptable?
--
Sincerely,
Demi Marie Obenour (she/her/hers)