You've just invented from first principles Single Sign On, OAuth, SAML, and Identity Providers.

You can rent it from AWS, of course. It's called Cognito.

https://aws.amazon.com/cognito/

You can also offload that responsibility for user data/credentials to Google/Facebook et al as you see many places with "Login with Facebook", making your users pay in privacy-invasion instead of bearing the burden of properly securing your user's PII yourself...

Mozilla Persona was deaigned so "the identity provider does not know which website the user is identifying on." But it did nto catch on.

As a user, it seemed like "so i need to login to Google on Mozilla.org... it's just a wrapper for my Gmail and/or Mozilla account?"

Not just a privacy invasion but also a single point of failure/an account shutdown.

This is a great idea and someone should do it.

Specialize in storing personal data (name, address etc.)

Provide APIs that only allow gentle exfiltration of data. e.g. < 10K queries per minute/hour/day whatever.

Have alternate paths (e.g. manual procedures) when greater volumes are required (e.g. for disaster recovery testing).

Then get it audited to death by some serious security firms.

Would this be something companies would pay for?

A FAANG wouldn't, but a corporate building e.g. a second-tier system holding customer data might.

Off-topic, but why is there no M in FAANG?

Rejected due to poor culture fit.

The term was originally coined in order to talk about stock price behavior.

There's a group out of the University of Warwick that's trying to commercialize a similar idea.

https://www.hubofallthings.com/main/what-is-the-hat

Like azure Key Vault? I’m sure AWS and google have something similar.

Or host your own by using Hashicorp Vault.

A single target for all gangsters on the planet? A convenient one-stop-shop, as opposed to having to penetrate multiple different services with vastly different technology stacks and protections and to then normalize data stored in a multitude of different formats? Sounds great, for attackers.

Wouldn't this really just turn into a database as a service?

Since it's users, maybe call it a directory... And since it's changing, maybe even an Active Directory? Like this https://aws.amazon.com/directoryservice/ ?

But then we need some sort of Protocol to Access the Directory. It should be something Lightweight, ideally. ;)

LDAP?

No. It should prevent something like "SELECT * FROM users WHERE sex="F" and age=18".

So, a database?