3 ms·

I've thought about this before, and there's a fundamental problem. If there are just a few physical locations where the reset can occur, nobody who lives far f

I've thought about this before, and there's a fundamental problem. If there are just a few physical locations where the reset can occur, nobody who lives far from those locations can reasonably use the service. The risk is too great. If there are lots of physical locations, then the whole purpose of the service is defeated. There's no way to control the people working at all those locations, and surely some of them will become compromised. I think the only solution is to somehow integrate with something like a bank or post office that seem to have already solved the problem of operating many secure retail locations.

robcohen 4y ago
Yes! I came to the same conclusion. Realistically the post office is the best way to do this. Furthermore, what's always frustrated me is how identity in the US is associated with an address. Why not just generate a one time code that resolves to a registry, and enable the receiver to modify the address that the code resolves to. This could even be done while the address is in transit. This also has the benefit of not losing mail to old addresses anymore. As someone who's lived in an RV full time, this was a particularly frustrating problem for me.
- CommitSyn 4y ago
  LibertyX (cash to BTC company) did something similar - at first you could only buy from stores that had Qpay (mobile phone top-up provider) and had signed up with LibertyX. Then they came to an agreement with Walgreens/CVS to allow users to pay cash and get Bitcoin at most or all CVS and Walgreens locations in the nation. USPS and banks already verify photo IDs on a daily basis and they're not afraid to work with companies to provide an additional service if the money is right. The problem for something like USPS would be paying enough up front to make it worth training and educating at least one or two individuals at every single post office in the entire United States on how to verify and reset the passwords. Although I suppose a similar measure using existing systems would be to send a code via registered mail with a post office hold - ensuring that even if someone is able to request a password reset, they have to also be able to go to the local post office of said person, with a fake photo ID of that person in hand. If it needs to be even more high-security to ensure USPS is following protocol, then users can opt to send a current photo of themselves on registration and instead of a password reset code, they'd receive a video chat code which allows a trained employee at EmailCompany to see and talk to them briefly and verify it's the same user who registered the email. I'm curious who this complex service would be used by - I'm assuming crypto exchanges, etc, but then that doesn't do anything for someone just getting your password and not needing to reset it. I suppose when you set your password you can receive a list of OTPs to use on session timeout/new device.
rkangel 4y ago
> There's no way to control the people working at all those locations Except that you then give two examples of services that have solved this problem. I'm not saying that it's an easy problem, but it's clearly not impossible.
- thatguy0900 4y ago
  Fraud in banks and the post office is a thing that happens, though. If you are concerned about your employees being compromised then contracting with a third party whose employees you don't control and don't answer to you probably isn't the solution.

robcohen 4y ago

Yes! I came to the same conclusion. Realistically the post office is the best way to do this. Furthermore, what's always frustrated me is how identity in the US is associated with an address. Why not just generate a one time code that resolves to a registry, and enable the receiver to modify the address that the code resolves to. This could even be done while the address is in transit. This also has the benefit of not losing mail to old addresses anymore. As someone who's lived in an RV full time, this was a particularly frustrating problem for me.

CommitSyn 4y ago
LibertyX (cash to BTC company) did something similar - at first you could only buy from stores that had Qpay (mobile phone top-up provider) and had signed up with LibertyX. Then they came to an agreement with Walgreens/CVS to allow users to pay cash and get Bitcoin at most or all CVS and Walgreens locations in the nation. USPS and banks already verify photo IDs on a daily basis and they're not afraid to work with companies to provide an additional service if the money is right. The problem for something like USPS would be paying enough up front to make it worth training and educating at least one or two individuals at every single post office in the entire United States on how to verify and reset the passwords. Although I suppose a similar measure using existing systems would be to send a code via registered mail with a post office hold - ensuring that even if someone is able to request a password reset, they have to also be able to go to the local post office of said person, with a fake photo ID of that person in hand. If it needs to be even more high-security to ensure USPS is following protocol, then users can opt to send a current photo of themselves on registration and instead of a password reset code, they'd receive a video chat code which allows a trained employee at EmailCompany to see and talk to them briefly and verify it's the same user who registered the email. I'm curious who this complex service would be used by - I'm assuming crypto exchanges, etc, but then that doesn't do anything for someone just getting your password and not needing to reset it. I suppose when you set your password you can receive a list of OTPs to use on session timeout/new device.

rkangel 4y ago

> There's no way to control the people working at all those locations Except that you then give two examples of services that have solved this problem. I'm not saying that it's an easy problem, but it's clearly not impossible.

thatguy0900 4y ago
Fraud in banks and the post office is a thing that happens, though. If you are concerned about your employees being compromised then contracting with a third party whose employees you don't control and don't answer to you probably isn't the solution.