Re:The "email is authentication" pattern
by kmoser on Sunday September 08, 2024 @01:09PM
(#41481566)
I don't want a government entity, or really any entity I'm not paying directly for their services, to be the gatekeeper between me and my accounts.
The social engineering attack surface of my account currently consists of a handful of support contacts at my ISP, who have been trained to deal with computer security. If you allow any USPS employee to access your account, you've suddenly increased the potential attack surface by several orders of magnitude.
Re:The "email is authentication" pattern
by nine_k on Sunday September 08, 2024 @08:58PM
(#41484585)
(1) Your USPS-provided email should neither be mandatory nor the only acceptable email. It could be an extra convenience, and a low-friction way to get a reasonably secure email for first-time / technically unsavvy users.
(2) An entity you're directly paying to may go out of business, sometimes due to circumstances beyond their control. At least state-sponsored entities don't do it so abruptly in most of the "civilized world".
edit: Also also, they have to go into a physical post office and be observed trying to steal your account. Given how it's quite possible to steal accounts via social engineering, this seems like an improvement in security, not a reduction.