6 ms·
The service you propose will either have the same problem as google, be vulnerable to social engineering attacks (like phone number providers), or be tied to ex
by creato 5y ago
The service you propose will either have the same problem as google, be vulnerable to social engineering attacks (like phone number providers), or be tied to extremely expensive infrastructure (e.g. enable post office or DMV offices to validate identity for the purposes of managing access to this account).
Even if google had customer support agents, what do you want them to do in cases like this? They can't actually validate anyone as the owner of an account, they'd simply be the targets of people begging to access accounts.
Edit: the implication being, we probably simply need most people to just not depend on email for anything important. Unless you can maintain multiple 2FA methods, your email account isn't reliable enough to be trusted with important things.
- bloak 5y agoYes, it would be "tied to extremely expensive infrastructure" ... that already exists. So no additional cost.
- ulrikrasmussen 5y agoIn my country (Denmark) every person and legal entity has a government-issued digital identity (NemID) so the authentication process is trivial and cheap.
- mavhc 5y agoDid they fix the security flaws mentioned on https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID yet?
- ulrikrasmussen 5y agoThe provider of the system is being replaced, which means that NemID will be replaced with MitID. This solves some security issues, but brings others. Most importantly, MitID, unlike NemID, does not allow the service provider to embed the login form, but always sends you to the identity provider to log in. On the other hand, you no longer need to input both a password and use a second factor (key card, code generator or phone app). In MitID, it is enough to enter your username and approve in the phone app. This is quite bad, and has led to the comical recommendation that you should pick a username that is hard to guess. Comical because the main argument for not requiring a password is to make the system easier to use, because passwords are hard to remember.
- mavhc 5y agoProbably need to call the Estonians
- throwawayvibes 5y agoSame in the Netherlands with DigiD. The name is an awful pun. Very Dutch.