2factor auth

[seth vidal]

On Mon, 2011-10-17 at 16:32 -0500, Bruno Wolff III wrote:
> On Mon, Oct 17, 2011 at 17:11:49 -0400,
>   seth vidal <skvidal at fedoraproject.org> wrote:
> > 
> > So - my questions are:
> >  1. Is requiring an android/ios device too onerous?
> >  2. Does the 'here's how it should work' section above make sense/seem
> > secure to everyone?
> >  3. who should we be requiring to use this? sysadmin-main? sysadmin-*,
> > anyone with a shell account? Would it make sense to make ssh keys + OTP
> > auth to get onto fedorapeople.org at all? what about fedorahosted?
> 
> Hopefully you aren't going to make this a requirement for all packagers.
> (I wasn't sure if Fedora committers referred to packagers or some other
> group.) I don't have any kind of cell phone right now (though work might
> buy me a dumb one in the future for work use) and buying one for Fedora would
> be pretty expensive.


to be fair - it doesn't require a smart phone - just a handheld device
running ios or android. Heck, I suspect it will probably run on the
android emulator.

but - your point is not an invalid one - and that is what this thread is
all about ,really - to figure out who should be covered and what is
enough vs too much.

-sv