Every vendor's secure email portal I have ever used was ultimately authenticated using my email account. Any one-time passcodes are sent to the same email. Password recovery? Email. If a malicious user is on my PC or otherwise intercepting my mail, they could access 100% of the solutions I've got access to right now.
When BofA sends me a new statement I need to:
* click on the link in my inbox
* wait for the email-provider to scan the email (and Office 365 does sometimes tell me they can't scan the link)
* Enter my username & password
* Select that I want my 2FA via call or text
* Wait for the call or text to arrive
* Enter it (now I'm signed in)
* search my house for my YubiKey
* lean over to insert YubiKey
* click cancel on the Windows popup for the passkey
* click cancel on the Bitwarden popup for the passkey
* click Physical key on the Chrome / Edge popup for passkeys
* put in YubiKey pin
* lean over again to physically touch YubiKey
* Click no on the next credit card offer
* Navigate to Credit Cards
* Click the Credit Card
* Click Documents
* Click current statement
when I'm on my walk (which I do anyway)
* insert key in mailbox
* (no delay) open mailbox
* (no delay) take out letters
* (no delay) close mailbox
* (no delay) remove key
* walk home
* open statement
* validate statement
* trash statement
Here in the US we only wish things were that secure.
Unless by 2FA you mean “code sent via SMS”.
Bluesky follows this pattern for the benefit of the user. The internet tradition has always been: if you want to control it, you have to host it.
In the context of sending a secure message, the sender maintaining control goes in the negatives column. At best it's a compromise in exchange for specific security features.
I actually think there is a more general opportunity here with AI. Every app and website and UI I use is optimized by a gaggle of PMs to achieve business objectives that don't necessarily benefit me. AI is getting to the point where soon it will be able to use these non-aligned UIs for me, and present to me a much simpler UI customized just for me, that does what I actually want and no more.
- Fetch your emails using any of the common local mail sync tools
- Some processing to clean up the plaintext version, may not be necessary even
- Send it to an LLM to extract a link
- Open up a headless browser, trigger something like SingleFile to extract its content.
Though you'll have to keep the cookie refreshed, but if it is initially logged in, this should be fine since you can also program something to keep refreshing every once in a while.
Then there are the national governments and things like insurance companies. All happily sending message notifications where you need to sign in to their own portals.
Securing email is too complex, so everyone builds their own secured portal thingy, and your mailbox has become a receptacle for notifications. Figuring out a solution would require cooperation, pragmatic lawmaking, and giving up those nice cashcows of moated portals, so it won't happen.