3 ms·
I understand the business factors that require initial account creation to be frictionless, and so why proof of identity must be weak, but why can't account rec
by rectang 5y ago
I understand the business factors that require initial account creation to be frictionless, and so why proof of identity must be weak, but why can't account recovery offer an option where you prove your identity indisputably?
For example, some sort of physical storefront (possibly run by an independent company), where you go and say I am so-and-so and here's my ID and please take my picture and my fingerprints so that if I'm scamming I'll be easy to catch and here's twenty bucks for your trouble.
I'd rather do that then spend weeks or months locked out, uncertain, and talking to a wall.
Privacy advocates won't be happy, but Facebook, Google, etc. don't have the same motivations as privacy advocates.
- pxeboot 5y agoThat is essentially what mobile phone carriers do, yet "customers" provide fake/stolen IDs all the time to perform sim-swap attacks and obtain financed phones they never plan to make a payment on.
- namibj 5y agoGermany has a suitable system built on an NFC chip in the federal ID (Personalausweis). When you get it (renewed), you get a transport pin, which you can use to set a regular usage pin, which you can then use to auth yourself to the NFC chip and make it provide some signed information to the remote end. Also, they are not particularly easy to fake to a degree that passes spot checks, anyways.
- saddlerustle 5y agoFacebook does sometimes ask for a scan of government ID in the account recovery flow. Unfortunately the cost of operating the ~100,000 storefronts required to be nearby a significant fraction of its users would be absurd compared to the benefits.
- gjs278 5y agoit could be as easy as going to a notary