News for hackers. Stuff that matters.
Re:The "email is authentication" pattern by terribleperson on Saturday September 07, 2024 @07:12PM (#41477019)
I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.
Re:The "email is authentication" pattern by ww520 on Saturday September 07, 2024 @07:56PM (#41477197)
That takes email spamming to the next level. (I'll show myself out...)
Re:The "email is authentication" pattern by hnbad on Saturday September 07, 2024 @07:52PM (#41477188)
Germany has PostIdent: you are issued a code, take it to the closest post office, hand them the code (originally this involved printouts) and your ID card and they scan your ID card and enter it into their system where the issuer of the code can then request that info to verify your identity.

This has largely been replaced by videochat for ID card verification where some underpaid person walks you through holding your ID card in front of your smartphone cameras to verify that it's real, not CG, not tampered with and matches your claimed identity.

The critical aspect here is that you don't have to hand your ID card (or a picture of it) to the company that wants to know your identity. The post office or the videochat provider serves as a trusted source of truth.

Re:The "email is authentication" pattern by elros on Saturday September 07, 2024 @08:31PM (#41477360)
Initially when I moved to Germany I thought it was a bit of a hassle to have to go to the post office for PostIdent; now I actually miss the elegance and privacy of that system in other countries.
Re:The "email is authentication" pattern by noAnswer on Saturday September 07, 2024 @08:47PM (#41477420)
Or you hold our ID card to your phone and do it on the spot.

https://www.deutschepost.de/en/p/postident/geschaeftskunden/...

Re:The "email is authentication" pattern by kolmogorov on Sunday September 08, 2024 @12:23AM (#41478192)
Re:The "email is authentication" pattern by weikju on Saturday September 07, 2024 @07:18PM (#41477045)
Now you lock out the rest of the world until they can implement this and federate identities between countries.
Re:The "email is authentication" pattern by scubbo on Saturday September 07, 2024 @07:40PM (#41477132)
That's not a problem. Many systems and services have launched geolocked to certain countries before later expanding (Google Voice, for one).
Re:The "email is authentication" pattern by quectophoton on Saturday September 07, 2024 @08:31PM (#41477362)
Yes!

Stuff like national ID, banks, ISP, job search websites, doctor appointments, etc, require[1] having an email address, and it feels wrong using gmail and similar providers for these use cases that are already tied to you having a physical presence in that location anyway.

Could be provided by any local company, really, but postal services are not going to disappear anytime soon and they already have a second way of getting in contact with you if there's any issue (registered mail[2]).

Debit cards are already delivered through postal mail anyway, and there's not many things that are more sensitive than that.

[1]: Well, maybe doctor appointments don't require and only strongly encourage, but that doesn't affect the point too much.

[2]: https://en.wikipedia.org/wiki/Registered_mail

Re:The "email is authentication" pattern by alberth on Saturday September 07, 2024 @09:18PM (#41477523)
To get a RealID drivers license in the US, which will be required to board a plane soon, requires all of the above and more.

It’s a government in-person KYC.

Re:The "email is authentication" pattern by tbrownaw on Saturday September 07, 2024 @10:34PM (#41477808)
> which will be required to board a plane soon

Assuming that this time the deadline doesn't get pushed back at the last minute again like has kept happening so far.

Re:The "email is authentication" pattern by chrisweekly on Saturday September 07, 2024 @11:16PM (#41477958)
Passport will also work
Re:The "email is authentication" pattern by FireBeyond on Saturday September 07, 2024 @09:59PM (#41477673)
The irony with that is that if someone undocumented wanted to leave the country, this requirement could potentially hinder that.

I also don't really want to have to carry my green card around everywhere. Just one more thing that can be lost.

Re:The "email is authentication" pattern by alberth on Saturday September 07, 2024 @11:58PM (#41478116)
How would it?

To travel internationally, a passport is required (not drivers licenses).

Re:The "email is authentication" pattern by FireBeyond on Sunday September 08, 2024 @12:01PM (#41481172)
I might have been being more simplistic than I needed to be, because there are other travel methods, but I was more meaning, "Not everyone lives next door to an international hub" (so might need a connecting domestic flight).
Re:The "email is authentication" pattern by eesmith on Sunday September 08, 2024 @02:54AM (#41478679)
Not 100% required, even for adults.

Those without acceptable identification may complete an identity verification process and face additional screening. https://www.tsa.gov/travel/security-screening/identification

Re:The "email is authentication" pattern by bombcar on Sunday September 08, 2024 @07:14AM (#41479715)
Everyone should experience this at least once - it’s eye opening.

I did it involuntarily because I forgot my wallet once, and decided “well, I’ll either get through and in my way, or I’m too late to drive home anyway and will miss” - and it worked fine.

Even crossed back into the USA without my passport a few times. Just additional screening and bitching is all (at least if you’re a US citizen; membership in the Empire has its perks!).

Re:The "email is authentication" pattern by loeg on Sunday September 08, 2024 @01:27PM (#41481711)
RealID requirement for domestic flights (still) isn't happening, just like it hasn't happened since it was first announced for requirement in 2008.
Re:The "email is authentication" pattern by kmoser on Saturday September 07, 2024 @10:59PM (#41477892)
No, thank you. I don't want anybody with a fake ID of me to be able to take control of my email. I want to use my password, I want it strongly encrypted at rest, and I want to be able to reset it remotely any time of day, without waiting for the USPS office to open.
Re:The "email is authentication" pattern by terribleperson on Saturday September 07, 2024 @11:07PM (#41477919)
Is a fake ID going to fly at the post office, where they can scan them? Also, I was imagining they'd want more than just an ID.

edit: Also also, they have to go into a physical post office and be observed trying to steal your account. Given how it's quite possible to steal accounts via social engineering, this seems like an improvement in security, not a reduction.

Re:The "email is authentication" pattern by kmoser on Sunday September 08, 2024 @01:09PM (#41481566)
I don't want a government entity, or really any entity I'm not paying directly for their services, to be the gatekeeper between me and my accounts.

The social engineering attack surface of my account currently consists of a handful of support contacts at my ISP, who have been trained to deal with computer security. If you allow any USPS employee to access your account, you've suddenly increased the potential attack surface by several orders of magnitude.

Re:The "email is authentication" pattern by nine_k on Sunday September 08, 2024 @08:58PM (#41484585)
(1) Your USPS-provided email should neither be mandatory nor the only acceptable email. It could be an extra convenience, and a low-friction way to get a reasonably secure email for first-time / technically unsavvy users.

(2) An entity you're directly paying to may go out of business, sometimes due to circumstances beyond their control. At least state-sponsored entities don't do it so abruptly in most of the "civilized world".

Re:The "email is authentication" pattern by bouncing on Tuesday September 10, 2024 @04:59PM (#41505487)
The account recovery process for commercial email providers usually involves you photographing your ID. Presumably the post office, in person, would be far less likely to be fooled.
Re:The "email is authentication" pattern by thbb123 on Saturday September 07, 2024 @11:35PM (#41478012)
The french postal services does that and includes a digital wallet and cloud repository.for instance, my paycheck certificates are delivered on this wallet.

Besides, the french administration is providing its own global scheme for online authentication.

Right now it works for all public services, but it is also open to all willing businesses.

It makes it also very easy to control tightly what kind of information is distributed to various services and businesses.

Re:The "email is authentication" pattern by aborsy on Sunday September 08, 2024 @12:35AM (#41478231)
What are the names of these services, to see how they work, their recovery process and abuse prevention?
Re:The "email is authentication" pattern by palsecam on Sunday September 08, 2024 @02:44AM (#41478645)
https://www.laPoste.fr/digiposte (digital safe) & https://laPoste.net/accueil (e-mail); offered by the postal services.

https://FranceConnect.gouv.fr/ is the online auth provided by the administration.

Re:The "email is authentication" pattern by imoverclocked on Saturday September 07, 2024 @11:57PM (#41478109)
I’m not sure I trust USPS to get all of the ins/outs of email spam/security/ux right. Google has spent a lot of resources to get Gmail to where it is today, starting from scratch (or OSS) seems like a big ask.

Maybe we just ask for an open authentication system instead? Leave the email part to someone else… and maybe the open authentication can plug a crypto app/email/phone backend for recovery once it is setup. Heck, given that’s it’s the USPS, they will probably offer a snail-mail recovery option (for better or worse.)

Re:The "email is authentication" pattern by chii on Sunday September 08, 2024 @01:20AM (#41478350)
I don't want a semi-gov't authorized service like this. Because its existence means services would want to mandate it (even if they don't truly need it), and force users to identify themselves directly - may be even across services (by matching their email address, which now must be unique as it is identity-linked).

I personally sign up to all online services with a different email each. I would like to be sure that my identity is hidden behind an alias for all services, so that they cannot be linked together. And if i want multiple accounts (for better or worse), i should be able to achieve that end.

Re:The "email is authentication" pattern by throwaway290 on Sunday September 08, 2024 @03:32AM (#41478802)
Australia is working on zero knowledge proof. The end service only knows that you are legit/of age/etc (only what it needs) because gov service confirmed it, but does not know who you are
Re:The "email is authentication" pattern by bouncing on Tuesday September 10, 2024 @04:57PM (#41505463)
And what does the Australian government know? Could it collect who you identified with?