Is it posible to validate a new user account/reset password without sending an email or phone number?

Question

I am intrested in creating a login mechanism which would create a user and validate his account, without using any of his details such as email, phone number etc.

Here is what I can think of :

• Allow user to sign up from a website. This uses their browser
• Make them download an application on their phone/desktop
• They then sign in using ther username and password as defined in step 1
• In the app, they click a button to verify their account
  
  

Some problems that I can think of

• If using the desktop version instead, they could create an auto click/type bot in order to validate
• User may have forgotten their username/password and they are signed out on their phone/desktop application, meaning they have no way to reset their account
  
  

To fix the password reset issue, I could use Google's authenticator application to create a one time code. The problem with this is if the user does not have accsess to their phone

Would this be a viable method for creating a web/app based service without collecting the users personal information? If not, are there any other ideas or is this not realy posible?

If this is not needed in order to validate a users, would this work by securing an account (by using the phone app)

Answer 1

If the focus of the solution is on a mechanism to authenticate a user without collecting any of their personal info (like email id), then using a delegated authentication mechanism is one way to go. For example, OpenID could be used to leverage an external auth server for our authentication needs. This way, we don't have to store any personal information of the user. More information can be found here.

Now, if the focus is to implement an authentication mechanism yourself, and you do not want to use any recovery back-channel (such as email or phone number), then a multi-factor (MFA) option is the way to go - Google Authenticator, sending a push message to your phone app and so on. MFA for a desktop solution could be achieved via a 'soft token'. There are a few well known providers, such as Entrust or AuthAnvil.

Answer 2

An option to reset password without an email or phone number from the user may be providing the user a OTP to reset his password generated upon account creation, similar to the ones given in password reset emails. A long enough code with good randomness that makes it imposible to guess, changes once used, and previously used tokens aren't accepted can satisfy your requirement

This solution has two main problems:

• Doesn't solve the problem when the username is forgotten
• Has the same problem as non-expiring OTPs for password resets sent through email, if an attacker is able to compromise users computer or gets the token by other meanings then the user is impersonated. And in this case will never recover his account as he has no other way to change the password

If your requirement for privacy is prioritary enough to accept this issues it may be a way to do it

Answer 3

The email or phone number is mainly a security in case where the user forget his password. How can you identify whether the guy saying that he has forgotten his password is the true owner or a pirate if you have no second way to join the original user? Secret questions have proven to be either unrememberable by the user or guessable that some one knowing him. For example they were used to gain access to Sarah Palin's email during the campaign of 2012 simply because the answers could be found on internet...

Answer 4

We have implemented a password reset solution which helps to reset the password without any network connectivity. Here I am just sharing the idea, not exact logic as it is protected by IP.

The solution consists of a password reset server and a mobile client application. After downloading the application to the smartphone, the user registered to the password reset server and creates a shared secret. The client application is personalized with the shared secrets and this one time activity.

One the website or any other login page, when user clicks on Forgot Password link, password reset API is called. Server responds with a encrypted message in form of QR code, which can be decrypted correctly only by the personalized client app. The decryption logic is written inside the client application which is computed locally, so no network connectivity is required. This decrypted text is used as OTP during password reset.

The shared secret plays the key role here to encrypt the OTP on the server and successfully decrypt on client the device.

Same concept can be extended for account verification also. Now the challenge is to decide the logic which may depend on application design or organisation.