I was simply trying to clarify the challenge-response mechanism for the parent poster, not suggesting you use keychain dongles everywhere.
Regardless, the idea that the plaintext password doesn't have to leave the device (whether the device is a dongle, your phone, or the keychain application) is a valuable consequence of the challenge-response mechanism, and I wish support for it were more widespread.
The server sends a challenge to the client. The client computes response = f(challenge, password), and sends the response. Then the server compares the response with its own computation of f(challenge, password). Since f is some type of hash function, we can assume that the client knew the actual password, as it would have been too hard computationally to come up with the correct response without it.
In such a scheme, the keychain can do the computation and the password never leaves the keychain. We can even go as far as to have the keychain be separate hardware (eg USB dongle), so the password never even has to exist on the client's computer at all.
I am curious about GPL compatibility in this situation. According to [1], software developed by US federal government cannot be licensed under the GPL since it is automatically in the public domain. However, the github repo readme makes the following claim:
"The project utilizes code licensed under the terms of the GNU General Public License and therefore is licensed under GPL v2 or later."
While I applaud this effort and wish to see more like it in the future, is there a possible issue with licensing here?