3 ms·
Presumably a service would only allow one (or a few) accounts per actual person. The end user will still need some amount of security. I had in mind some challe
by zwegner 13y ago
Presumably a service would only allow one (or a few) accounts per actual person. The end user will still need some amount of security. I had in mind some challenge-response mechanism, like:
Person signs government ID number with public key, presents it to authority
Authority signs public key and asserts it belongs to a real human
Service presents random number at signup time
Person signs the random number with the same public key, and presents the key signed by the authority
- Lambdanaut 13y agoI'm not entirely sure how that would mitigate people from passing the government signed public key to their bot and letting it take over from there.
- zwegner 13y agoThat's what I was referring to with services only allowing one (or N) accounts per person. A spammer could use the signature multiple times, but would need new email providers for every single account. And as an uncle (?) comment points out, there could possibly be blacklists of signatures of spammers shared between providers. That definitely would cause some new problems, of course, but who knows what the future may hold...
- Lambdanaut 13y agoOh I see. I hope it doesn't ever come to that!