On Mon, Feb 21, 2022 at 7:17 PM Vitaly Zaitsev via devel
<devel(a)lists.fedoraproject.org> wrote:
OTP is absolutely free. FIDO2 requires the purchase of a special
hardware token.
Not necessarily. Not only can some mobile devices
present the needed credentials (as if they were an
external hardware token), but as I recall U2F specifies
a TPM(2?) chip as a possible secure processor.
While I don't remember where, I think I did once see
a reference to where someone had created a TPM
based FIDO implementation.
But I agree there are some known problems in
obtaining a $10(US) FIDO2 token.