4 ms·

It's pretty crazy to think about the fact that your email is de-facto your online identity, as it is the universal second factor that is used as a fallback if o

It's pretty crazy to think about the fact that your email is de-facto your online identity, as it is the universal second factor that is used as a fallback if other login mechanisms fail. An email service is two things: a global name user@emailprovider.tld, which is really your online identity, and an email service that hosts the SMTP, IMAP and DNS services required for the identity to function. People are willing to hand over not just the ownership of the service but also their global digital identity (the email address) to a third-party which now assumes total control of it, and which does not have any interest in supporting you. It is a major hassle to move to another provider, even a paid one, because your email address is tied to the service provider. Because email addresses are practically a requirement to function in society, I think they should be a public service. Everyone should have the right to get an email address controlled by a public service institution which guarantees you that you can move between service providers as you please. There could even be a standardized protocol that service providers could use to easily update DNS entries when the user requests a move, assuming that you can identify yourself via some other means.

creato 5y ago
The service you propose will either have the same problem as google, be vulnerable to social engineering attacks (like phone number providers), or be tied to extremely expensive infrastructure (e.g. enable post office or DMV offices to validate identity for the purposes of managing access to this account). Even if google had customer support agents, what do you want them to do in cases like this? They can't actually validate anyone as the owner of an account, they'd simply be the targets of people begging to access accounts. Edit: the implication being, we probably simply need most people to just not depend on email for anything important. Unless you can maintain multiple 2FA methods, your email account isn't reliable enough to be trusted with important things.
- bloak 5y ago
  Yes, it would be "tied to extremely expensive infrastructure" ... that already exists. So no additional cost.
- ulrikrasmussen 5y ago
  In my country (Denmark) every person and legal entity has a government-issued digital identity (NemID) so the authentication process is trivial and cheap.
  - mavhc 5y ago
    Did they fix the security flaws mentioned on https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID yet?
    - ulrikrasmussen 5y ago
      The provider of the system is being replaced, which means that NemID will be replaced with MitID. This solves some security issues, but brings others. Most importantly, MitID, unlike NemID, does not allow the service provider to embed the login form, but always sends you to the identity provider to log in. On the other hand, you no longer need to input both a password and use a second factor (key card, code generator or phone app). In MitID, it is enough to enter your username and approve in the phone app. This is quite bad, and has led to the comical recommendation that you should pick a username that is hard to guess. Comical because the main argument for not requiring a password is to make the system easier to use, because passwords are hard to remember.
      - mavhc 5y ago
        Probably need to call the Estonians
  - throwawayvibes 5y ago
    Same in the Netherlands with DigiD. The name is an awful pun. Very Dutch.
Gareth321 5y ago
I fully agree. Over the years I've been reading about people being locked out of their Gmail accounts, and the YEARS of pain they had to go through to try to regain access to the countless connected services. You don't realise how many hundreds of services require access to your email account until you lose access. The final straw was reading the heartbreaking account of someone who lost decades worth of personal pictures, critical emails, and access to everything that mattered to him. Google's response was worse than "get lost." So I bought my own domain and have spent the last year slowly migrating everything over. I'm still only ~30% of the way there. My whole life was centered around that Gmail address, and I could have lost it in an instant for any and no reason at all. It's horrifying, and happens to perhaps thousands of people every day. As we continue to SaaSify everything this problem is going to come to the fore sooner rather than later. Our entire lives live in the cloud now and it can be deleted without cause or notice. At the very least I would like to see governments issue people a free state email address which can be hosted anywhere. Email is now a necessity.
- toastal 5y ago
  Keep it up though. And encourage a friend.
ihateolives 5y ago
> Because email addresses are practically a requirement to function in society, I think they should be a public service. Everyone should have the right to get an email address controlled by a public service institution which guarantees you that you can move between service providers as you please. In some countries it has already been for a long time, for example Estonia gives everyone by default an email address that is tied to their national ID and you can forward mail from that address to any provider you want. Edit: Anybody barely uses it though because usually there is no need. But it's there in case you want to use it.
scionthefly 5y ago
In the US, I have long thought the USPS missed several good opportunities to get involved in the internet revolution in the 90s. This is a major one.

creato 5y ago

The service you propose will either have the same problem as google, be vulnerable to social engineering attacks (like phone number providers), or be tied to extremely expensive infrastructure (e.g. enable post office or DMV offices to validate identity for the purposes of managing access to this account). Even if google had customer support agents, what do you want them to do in cases like this? They can't actually validate anyone as the owner of an account, they'd simply be the targets of people begging to access accounts. Edit: the implication being, we probably simply need most people to just not depend on email for anything important. Unless you can maintain multiple 2FA methods, your email account isn't reliable enough to be trusted with important things.

bloak 5y ago
Yes, it would be "tied to extremely expensive infrastructure" ... that already exists. So no additional cost.
ulrikrasmussen 5y ago
In my country (Denmark) every person and legal entity has a government-issued digital identity (NemID) so the authentication process is trivial and cheap.
- mavhc 5y ago
  Did they fix the security flaws mentioned on https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID yet?
  - ulrikrasmussen 5y ago
    The provider of the system is being replaced, which means that NemID will be replaced with MitID. This solves some security issues, but brings others. Most importantly, MitID, unlike NemID, does not allow the service provider to embed the login form, but always sends you to the identity provider to log in. On the other hand, you no longer need to input both a password and use a second factor (key card, code generator or phone app). In MitID, it is enough to enter your username and approve in the phone app. This is quite bad, and has led to the comical recommendation that you should pick a username that is hard to guess. Comical because the main argument for not requiring a password is to make the system easier to use, because passwords are hard to remember.
    - mavhc 5y ago
      Probably need to call the Estonians
- throwawayvibes 5y ago
  Same in the Netherlands with DigiD. The name is an awful pun. Very Dutch.

Gareth321 5y ago

I fully agree. Over the years I've been reading about people being locked out of their Gmail accounts, and the YEARS of pain they had to go through to try to regain access to the countless connected services. You don't realise how many hundreds of services require access to your email account until you lose access. The final straw was reading the heartbreaking account of someone who lost decades worth of personal pictures, critical emails, and access to everything that mattered to him. Google's response was worse than "get lost." So I bought my own domain and have spent the last year slowly migrating everything over. I'm still only ~30% of the way there. My whole life was centered around that Gmail address, and I could have lost it in an instant for any and no reason at all. It's horrifying, and happens to perhaps thousands of people every day. As we continue to SaaSify everything this problem is going to come to the fore sooner rather than later. Our entire lives live in the cloud now and it can be deleted without cause or notice. At the very least I would like to see governments issue people a free state email address which can be hosted anywhere. Email is now a necessity.

toastal 5y ago
Keep it up though. And encourage a friend.

ihateolives 5y ago

> Because email addresses are practically a requirement to function in society, I think they should be a public service. Everyone should have the right to get an email address controlled by a public service institution which guarantees you that you can move between service providers as you please. In some countries it has already been for a long time, for example Estonia gives everyone by default an email address that is tied to their national ID and you can forward mail from that address to any provider you want. Edit: Anybody barely uses it though because usually there is no need. But it's there in case you want to use it.

scionthefly 5y ago

In the US, I have long thought the USPS missed several good opportunities to get involved in the internet revolution in the 90s. This is a major one.