8 ms·

At some point in time we decided that email addresses control the keys to the kingdom. If you lose access to your email, there goes your social media accounts,

by Taek 6y ago

At some point in time we decided that email addresses control the keys to the kingdom. If you lose access to your email, there goes your social media accounts, your bank accounts, your gaming accounts, and potentially many of your commercial accounts as well. And then we decided that custom domains are the most professional. Which does make sense, there can only be one 'robert@gmail.com'. But, this is coupled with the idea that domains can expire, and that expiry does not appear to kill the identity that's potentially associated with the domain. We should not be using email addresses as our primary source of identity verification in the first place. And we definitely _should_ have some way to globally declare that an identity has been compromised. Especially given our society's track record of keeping database safe from breach. I more or less assume it is inevitable that one of my major accounts will be compromised, and that this will be able to cascade into most of my major accounts being compromised. I do what I can to protect myself, but gmail as a single source of failure makes me nervous. Using any email provider besides gmail makes me even more nervous, because they don't have the full power and knowledge of Google protecting their databases.

hirsin 6y ago
CAEP provides this to some extent https://openid.net/wg/sse/ https://openid.net/wg/sse/ - but now you're asking for a whole bunch of systems to be able to talk about you in back channels which other people will find fault with.
asciident 6y ago
You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, that people running custom domains and use them for email must deposit $500 in registration to do so (to ensure the domain is registered for their lifetime), and that they should be protected by a password plus 2FA with your phone being the other factor. And I propose that each person should be uniquely identifiable by an email address stored in a global publicly-accessible database.
- dewey 6y ago
  There's a difference between an email address and a social security number in a way that the latter will still be around if you stop paying for it or something happens to you. In some way (at least for this threat model) a gmail address is better than one on your own domain as it's unlikely to go away or get taken over.
  - noinsight 6y ago
    Unless Google arbitrarily decides to close your account (as has been known to happen) with no way to contact a human to correct things...
  - leonidasv 6y ago
    You can get locked from Gmail if Google decides to suspend your Account. It has already happened to lots of users, even G Suite ones and good luck trying to get it back. Examples on HN: https://news.ycombinator.com/item?id=22146082 https://news.ycombinator.com/item?id=22146082 https://news.ycombinator.com/item?id=22705122 https://news.ycombinator.com/item?id=22705122 https://news.ycombinator.com/item?id=4013799 https://news.ycombinator.com/item?id=4013799
    - paulpauper 6y ago
      Google reallly sucks in this regard. You can also lose your account if someone hacks it and google cannot determine who it belongs to, so it belongs to no one despite not being suspended.
  - rgovostes 6y ago
    Until Google decides to recycle unused account names: https://www.wired.com/2013/06/yahoos-very-bad-idea/ https://www.wired.com/2013/06/yahoos-very-bad-idea/
  - PinguTS 6y ago
    Why should my own domain taken over. It can be taken over as easily as someone could take over my gmail. I use my own domain on my own server with my own running mail server. Why should someone take that over? Of course someone with state level hacking experience could do that, but I am not a target for those. Script kiddies have no luck, because you can't even login from the Internet into my server you will need to VPN into first.
paulpauper 6y ago
2FA works well in many instances if your email gets hacked
chrismarlow9 6y ago
At minimum register a domain and email forward the wildcard address for it to your daily driver. Use this for important things and don't forget to renew. Edit: you can do all this on namecheap pretty easily.
widforss 6y ago
"assume that a public key cryptosystem exists"
- anoncow 6y ago
  Some organisation will try to own it and then users will be at the risk of getting banned and losing themselves.
anoncow 6y ago
There are other aspects here. If you use a third party service for your email ID, the third party can ban you or like you mention - disappear and basically take your identity away. If you rely on national ID cards, you have another set of problems. If you rely on phone numbers, these can be sim-jacked. If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromised. Relying on any single source seems to be a recipe for disaster. Perhaps the solution is to have multiple ways to authenticate yourself, with different levels of credibility and to let as many of them survive as possible. Phone numbers and email IDs seem to have similar levels of credibility, but I haven't seen domain name service providers take to phone number authentication as much as I would have liked, but things are looking up. Alternatives could be backup codes, which some registrar's use if you have 2fa enabled.
- jmull3n 6y ago
  >If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromised. It's my understanding that these methods (TouchID, FaceID) don't actually store your thumb prints or images of your face rather they store hashes of the output. Similar to how passwords should never be stored in plain text.
  - Polylactic_acid 6y ago
    Its more than a hash since it needs to be able to match similar inputs (face at different angle, partially obscured), its probably just a bunch of raw measurements but not actually a photo of your face. The upside is its only stored on the device itself and not in a master database and also isn't used for any remote authentication so can't be exploited by hackers over the internet.
    - SpaceRaccoon 6y ago
      Theory: it can be a hash of measurements of the face, rounded to a certain precision.
notatoad 6y ago
Gmail is only a single failure point if you let it be one though - set up 2fa on all your accounts, and this problem is solved.
- ObsoleteNerd 6y ago
  Google bans/locks/deletes accounts for arbitrary reasons all the time, with absolutely zero recourse for the user.
jb775 6y ago
We should be using biometric markers filtered through homomorphic encryption. This way we can verify/prove our identity without handing over those markers to multiple 3rd parties.
- varenc 6y ago
  Biometrics are unrevokable. If yours are compromised through some other way then you can’t trust biometric authentication for the rest of your life.
  - Spivak 6y ago
    But that doesn’t matter! I hate this argument because it misses the point of biometric authentication as “something you are.” There’s no such thing as compromise or revocation. It’s a piece of public information that can’t be stolen or used by anyone other than yourself. The world can have high def scans of my fingerprint for all it matters, they can’t produce a living human finger with the same print. And if you can’t reasonably ensure that you’re taking a reading from a living human then you shouldn’t be using biometrics. Biometrics is not transmitting a picture of a fingerprint, it’s presenting your hand. Having your email secured by a password locked by a device you trust doing biometric auth is perfectly fine. Having a website somehow store your print isn’t.
    - zzma 6y ago
      > Biometrics is not transmitting a picture of a fingerprint, it’s presenting your hand. What would this "hand data" look like? A 3D model of a hand MRI or X-Ray? Based on my understanding, in any form of biometric authentication, some amount of static data (i.e. the biometric database is not receiving a secure, updating feed of the state of your hand/body) is stored on the server and compared with the data transmitted for authentication. Biometrics change (fingerprints can be rubbed off from gardening, DNA mutates, etc.), so this static biometric data is something that is mostly environment-invariant. If someone can compromise your "full hand scanner" or compromise the biometric database (which will inevitably happen), then you are compromised for life, since you cannot change your hand.
joedevon 6y ago
Indeed. What if you are a super responsible person, but there is unrest in a Country you are visiting or live in, through no fault of your own and you are unable to pay a renewal. Or you fall sick and go to the hospital.
giancarlostoro 6y ago
Maybe there should be some transparent way for mail servers to request public encrypted keys to an email address and any incoming mail gets decrypted by the private key. So if someone hijacks your domain any password reset emails should be gibberish unless they magically got the private key, in which case you have worse problems. This is the only technique I think might work till someone social engineers people at Twitter.
tiaait 6y ago
" but gmail as a single source of failure makes me nervous. Using any email provider besides gmail makes me even more nervous, because they don't have the full power and knowledge of Google protecting their databases. " Good Practice: Never use gmail for registrations. If you get locked out, that's it. Good luck trying to call google. Am people have gotten locked out or their gmail accounts been closed. I myself was not able to log into one of my gmail accounts and I had to reset a PW for a domain register that was about to expire. I was able to log in and save it since I managed to boot up an old laptop with a corrupted had drive for a few minutes. The Browser must have had a cockie associated with this gmail account.

by Taek 6y ago

hirsin 6y ago

CAEP provides this to some extent https://openid.net/wg/sse/ https://openid.net/wg/sse/ - but now you're asking for a whole bunch of systems to be able to talk about you in back channels which other people will find fault with.

asciident 6y ago

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, that people running custom domains and use them for email must deposit $500 in registration to do so (to ensure the domain is registered for their lifetime), and that they should be protected by a password plus 2FA with your phone being the other factor. And I propose that each person should be uniquely identifiable by an email address stored in a global publicly-accessible database.

dewey 6y ago
There's a difference between an email address and a social security number in a way that the latter will still be around if you stop paying for it or something happens to you. In some way (at least for this threat model) a gmail address is better than one on your own domain as it's unlikely to go away or get taken over.
- noinsight 6y ago
  Unless Google arbitrarily decides to close your account (as has been known to happen) with no way to contact a human to correct things...
- leonidasv 6y ago
  You can get locked from Gmail if Google decides to suspend your Account. It has already happened to lots of users, even G Suite ones and good luck trying to get it back. Examples on HN: https://news.ycombinator.com/item?id=22146082 https://news.ycombinator.com/item?id=22146082 https://news.ycombinator.com/item?id=22705122 https://news.ycombinator.com/item?id=22705122 https://news.ycombinator.com/item?id=4013799 https://news.ycombinator.com/item?id=4013799
  - paulpauper 6y ago
    Google reallly sucks in this regard. You can also lose your account if someone hacks it and google cannot determine who it belongs to, so it belongs to no one despite not being suspended.
- rgovostes 6y ago
  Until Google decides to recycle unused account names: https://www.wired.com/2013/06/yahoos-very-bad-idea/ https://www.wired.com/2013/06/yahoos-very-bad-idea/
- PinguTS 6y ago
  Why should my own domain taken over. It can be taken over as easily as someone could take over my gmail. I use my own domain on my own server with my own running mail server. Why should someone take that over? Of course someone with state level hacking experience could do that, but I am not a target for those. Script kiddies have no luck, because you can't even login from the Internet into my server you will need to VPN into first.

paulpauper 6y ago

2FA works well in many instances if your email gets hacked

chrismarlow9 6y ago

At minimum register a domain and email forward the wildcard address for it to your daily driver. Use this for important things and don't forget to renew. Edit: you can do all this on namecheap pretty easily.

widforss 6y ago

"assume that a public key cryptosystem exists"

anoncow 6y ago
Some organisation will try to own it and then users will be at the risk of getting banned and losing themselves.

anoncow 6y ago

There are other aspects here. If you use a third party service for your email ID, the third party can ban you or like you mention - disappear and basically take your identity away. If you rely on national ID cards, you have another set of problems. If you rely on phone numbers, these can be sim-jacked. If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromised. Relying on any single source seems to be a recipe for disaster. Perhaps the solution is to have multiple ways to authenticate yourself, with different levels of credibility and to let as many of them survive as possible. Phone numbers and email IDs seem to have similar levels of credibility, but I haven't seen domain name service providers take to phone number authentication as much as I would have liked, but things are looking up. Alternatives could be backup codes, which some registrar's use if you have 2fa enabled.

jmull3n 6y ago
>If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromised. It's my understanding that these methods (TouchID, FaceID) don't actually store your thumb prints or images of your face rather they store hashes of the output. Similar to how passwords should never be stored in plain text.
- Polylactic_acid 6y ago
  Its more than a hash since it needs to be able to match similar inputs (face at different angle, partially obscured), its probably just a bunch of raw measurements but not actually a photo of your face. The upside is its only stored on the device itself and not in a master database and also isn't used for any remote authentication so can't be exploited by hackers over the internet.
  - SpaceRaccoon 6y ago
    Theory: it can be a hash of measurements of the face, rounded to a certain precision.

notatoad 6y ago

Gmail is only a single failure point if you let it be one though - set up 2fa on all your accounts, and this problem is solved.

ObsoleteNerd 6y ago
Google bans/locks/deletes accounts for arbitrary reasons all the time, with absolutely zero recourse for the user.

jb775 6y ago

We should be using biometric markers filtered through homomorphic encryption. This way we can verify/prove our identity without handing over those markers to multiple 3rd parties.

varenc 6y ago
Biometrics are unrevokable. If yours are compromised through some other way then you can’t trust biometric authentication for the rest of your life.
- Spivak 6y ago
  But that doesn’t matter! I hate this argument because it misses the point of biometric authentication as “something you are.” There’s no such thing as compromise or revocation. It’s a piece of public information that can’t be stolen or used by anyone other than yourself. The world can have high def scans of my fingerprint for all it matters, they can’t produce a living human finger with the same print. And if you can’t reasonably ensure that you’re taking a reading from a living human then you shouldn’t be using biometrics. Biometrics is not transmitting a picture of a fingerprint, it’s presenting your hand. Having your email secured by a password locked by a device you trust doing biometric auth is perfectly fine. Having a website somehow store your print isn’t.
  - zzma 6y ago
    > Biometrics is not transmitting a picture of a fingerprint, it’s presenting your hand. What would this "hand data" look like? A 3D model of a hand MRI or X-Ray? Based on my understanding, in any form of biometric authentication, some amount of static data (i.e. the biometric database is not receiving a secure, updating feed of the state of your hand/body) is stored on the server and compared with the data transmitted for authentication. Biometrics change (fingerprints can be rubbed off from gardening, DNA mutates, etc.), so this static biometric data is something that is mostly environment-invariant. If someone can compromise your "full hand scanner" or compromise the biometric database (which will inevitably happen), then you are compromised for life, since you cannot change your hand.

joedevon 6y ago

Indeed. What if you are a super responsible person, but there is unrest in a Country you are visiting or live in, through no fault of your own and you are unable to pay a renewal. Or you fall sick and go to the hospital.

giancarlostoro 6y ago

Maybe there should be some transparent way for mail servers to request public encrypted keys to an email address and any incoming mail gets decrypted by the private key. So if someone hijacks your domain any password reset emails should be gibberish unless they magically got the private key, in which case you have worse problems. This is the only technique I think might work till someone social engineers people at Twitter.

tiaait 6y ago

" but gmail as a single source of failure makes me nervous. Using any email provider besides gmail makes me even more nervous, because they don't have the full power and knowledge of Google protecting their databases. " Good Practice: Never use gmail for registrations. If you get locked out, that's it. Good luck trying to call google. Am people have gotten locked out or their gmail accounts been closed. I myself was not able to log into one of my gmail accounts and I had to reset a PW for a domain register that was about to expire. I was able to log in and save it since I managed to boot up an old laptop with a corrupted had drive for a few minutes. The Browser must have had a cockie associated with this gmail account.