Re:FCC to require email addresses on applications for amateu...
by toomuchtodo on Friday December 04, 2020 @12:11PM
(#25304899)
Agree entirely! https://login.gov already exists. Extend it with PKI and smartcards (Estonia National ID style [1]). Have USPS be a trust anchor as well as integrate with Login.gov as an identity provider, and so on.
Do that, but go a little farther.
You should be able to register with the USPS to get a universal ID (UID), and then associate both a mailing address and an email address with that UID.
USPS would then provide both an email address and virtual mailing address that incorporate the UID. Email sent to that email address would forward to the real email address associated with the UID, and physical mail sent to the virtual mailing address would be delivered to the associated physical mailing address.
I'd like to see them also offer an ID verification service, that provides a way for you to verify to a third party that you control a particular UID. This could provide a robust account recovery mechanism for other services.
Right now, if an account at some service gets hijacked, or you simply forget or lose your credentials, recovery usually depends on SMS or on email. The problem with those is that they too can be hijacked, and their recovery also depends on SMS or email. You end up with a tangled mess of dependencies.
A way to fix this is to organize account recovery as a tree. At the root you have some service where recovery requires that you physically show up at their office and present proof of identity, such as a passport.
Then directly under the root you might have your main email account or your main mobile phone account. Account recovery for those would involve verifying your identity with the root.
Below those, you might have your social media accounts, your utility accounts, and so on. Recovery for those would involved verifying you via your mail email or main mobile number.
How you organize it is up to you. They key, though, is to have something at the top that you can always recover, and make everything else be ultimately recoverable through that. (I'd probably personally do a 5 level tree: root; domain registrars; main email; mobile phone; everything else).
USPS would be good for the root because they have offices all over the country. Most people can get to a USPS office without too much hardship. (Banks would also be a good option for root identity providers).