Timeline for Why is email often used as the ultimate verification?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 4, 2021 at 16:48 | comment | added | supercat | ...of the address won't be able to use it to receive 2FA emails intended for the old one. | |
| Jan 4, 2021 at 16:47 | comment | added | supercat | I wonder if there would be any difficulty standardizing an email header that would request that an email server discard most of a message if the present account did not exist on a particular date [the server could deliver a notice indicating that a message was discarded and indicating the date in a message]. While this would be "on the honor system" for the email provider, a promise to treat messages that way in future could be seen as desirable for the present clients of an email service (knowing that if the email address gets reissued but the service honors the promise, the new owner... | |
| Jan 3, 2021 at 15:16 | comment | added | AndrejaKo | @ Jörg W Mittag In many countries, a poste restante service is available, where you don't have your mail delivered to an address. Instead, you register a post office, and are expected to go there regularly to pick up your mail. | |
| Jan 3, 2021 at 13:56 | comment | added | Hagen von Eitzen | @JörgWMittag I don't think that "snail-mail verification will block access for all our homeless customers" is a thought that played a role in business decisions | |
| Jan 2, 2021 at 23:48 | comment | added | Jörg W Mittag | @JonBentley: But we are talking about accounts on web sites here. It is reasonable to assume that someone who has an account on a web site will also have access to some sort of means of receiving email, e.g. a gratis webmail provider. For example, homeless people who can briefly use a shared web terminal in a shelter. They will not be able to receive snail mail because they don't have an address. At least in some countries, they will not be able to have a SIM card for the same reason. They will, however, be able to access webmail at least during those times where they can access the web. | |
| Jan 2, 2021 at 22:03 | comment | added | Jon Bentley | @JörgWMittag By that logic, it is not universally true that everyone has an email address either, so your line of reasoning doesn't help to distinguish between any of the methods. I know several people (mostly older) who have a mobile phone, phone, and address, but no email address. | |
| Jan 2, 2021 at 11:49 | comment | added | Polygnome | @alephzero The recipient knows when they don't get the mail after some time. Or if somebody has opened the letter in transit. Especially the latter isn't true for digital communication. | |
| Jan 2, 2021 at 6:44 | comment | added | Steffen Ullrich | @alephzero: I'm not claiming that snail mail is perfectly secure - but neither is SMS or a phone call or an e-mail. I'm only saying that these are different options with different trade-offs regarding usability, costs and security. | |
| Jan 2, 2021 at 5:03 | comment | added | alephzero | With snail mail, how would you propose to avoid the security holes caused by the chain of people physically handling it? Any organization that is generating thousands of identical-looking snail mails per day is an obvious target for someone skimming off say 0.01% of them as "lost in the post". | |
| Jan 1, 2021 at 15:23 | comment | added | Jörg W Mittag | "While there are alternatives like SMS based verification, automated phone call or even snail mail, these are not as easy and cheap to use as e-mail." – They also assume that the user has a mobile phone, phone, or address, respectively, which is not universally true. | |
| Jan 1, 2021 at 13:27 | history | answered | Steffen Ullrich | CC BY-SA 4.0 |