I am intrested in creating a login mechanism which would create a user and validate his account, without using any of his details such as email, phone number etc.
Here is what I can think of :
- Allow user to sign up from a website. This uses their browser
- Make them download an application on their phone/desktop
- They then sign in using ther username and password as defined in step 1
- In the app, they click a button to verify their account
Some problems that I can think of
- If using the desktop version instead, they could create an auto click/type bot in order to validate
- User may have forgotten their username/password and they are signed out on their phone/desktop application, meaning they have no way to reset their account
To fix the password reset issue, I could use Google's authenticator application to create a one time code. The problem with this is if the user does not have accsess to their phone
Would this be a viable method for creating a web/app based service without collecting the users personal information? If not, are there any other ideas or is this not realy posible?
If this is not needed in order to validate a users, would this work by securing an account (by using the phone app)