I think the ultimate problem here is that the average person has no hardened mechanism for authentication. Using the infrastructure we have today, a combination

I think the ultimate problem here is that the average person has no hardened mechanism for authentication. Using the infrastructure we have today, a combination of passwords and OTPs is better than other consumer-accessible alternatives. Ultimately we need some mechanism for trusting and administering identity that is low friction and which can be used by 99.9% of users. The government offering a `login with apple id` like service would make sense. Then they could qualify various security chips, like the T2 or a YubiKey for use with the service. As an added benefit, we could stop using stupid things like SSNs, tax ids, and drivers license id numbers to prove identity. Eventually we could do interesting things like abstracting mailing addresses. Instead of mailing a package to my street address, send it instead to "me", and then I can authorize USPS, UPS, FedEx, or whoever requests it to look up my real address when they are sorting and delivering mail. When I move, I just update the _one_ database with my new address and I am done. There are some obvious concerns with the government acting as a clearing house for identity. Perhaps the better option would be for private companies to be able to implement some sort of standard API, and limit the government's involvement to auditing these services.