3 ms·
> It would 100% be more secure, requiring a state issued id card to reset your password. You seem to be under the illusion that state-issued id cards and even
by rrwo 4y ago
> It would 100% be more secure, requiring a state issued id card to reset your password.
You seem to be under the illusion that state-issued id cards and even passports are secure.
People are able to get them simply by showing a birth certificate, which is basically a piece of paper signed and stamped by a town official decades ago. Which comes down to trusting underpaid, overworked people (and possibly underqualified political appointees) who work at the local registry of births or drivers licensing agency or passport office.
Considering how important email is for peoples' lives nowadays (especially if it provides access to financial information), a state issued id may be a weaker link.
Are you able to detect forged passports and drivers licences? Will your business have insurance in case you make a mistake and reset the password for the wrong person?
Have you ever worked in an in-person customer-facing role before? You will encounter angry, sometimes aggressive people. If you're in the US, then expect some of them may be armed.
- tragictrash 4y agoI've worked in those roles for many years. I also busted my ass in dangerous blue collar under the table jobs for years before I got into software and my current position. My first software job was 80 hours a week at a startup for 35k a year, and I was happy to do it because it was on the books and I wasn't in danger of getting crushed by heavy machinery. Did I say that a state issued id would be the only form of id required to reset your password? No. That's pretty idiotic, and you know it would never fly in the real world. Come on, let's try and be an adult and stop with the straw man arguments. There's so many avenues of attack for the current password reset process (sim swapping, identity theft) that another layer would definitely improve security. Should we not do it because "oh no someone can forge an id"? Grow up and drop the straw man arguments.
- rrwo 4y agoYou said in the comment that I replied to > It would 100% be more secure, requiring a state issued id card to reset your password. And when I criticize that, you say I am making a "straw man" argument.