0

Most online accounts identify users using email/phone & password; but since most all email/phone is handled by another service (e.g. Gmail), one's online identity only exists so long as these services permit it; in a sense, the service owns the identity, and the user is just 'borrowing it'; or at least that's how I see this.

So if a person loses access to email/phone account and the services refuse to help recover it (be it for valid/invalid reasons), there's little one can do. Now, there are many factors to protect against the loss of the account (e.g. strong passwords, 2FA, reliable company, etc.) but managing risk is more than just prevention; there is also recovery.

The only close-to-guaranteed way I can see to recover an email, is to self-host it; even if the email server gets compromised, it can be rebuilt fresh/securely and life can go on. (For this question, not treating compromised emails as a major threat - the main focus is on the actual email account; not to invalidate that concern as it would be a big deal for say an online crypto wallet, but just not in scope of the question)

Now it's not perfect (dependent on the domain, ISP, etc.) but it cuts out a major middleman. Of course, self-hosting an email server is easier said than done; managing it and keeping it secure is not trivial.

Which brings us back to the question: if my statements and conclusions above are reasonably accurate, then is self-hosted email the closest one can get to owning one's online identity? I'm aware of a few concepts (see prior art) but unless you live in the right country or in the future, it seems today this is the most (if not very) practical option.

Am I thinking about this right, or are there more resilient alternatives (e.g. cut out more dependencies)? Or maybe comparable but easier alternatives?

Prior Art:

With government support, could do a legally backed identity like Estonia: https://en.wikipedia.org/wiki/Estonian_identity_card

Conceptually, I think what I'm asking for is self-sovereign identity; which apparently blockchain could be used? But not aware of any practical examples yet: https://en.wikipedia.org/wiki/Self-sovereign_identity

Focused on implementation, but not asking if there are alternative approaches: Dedicated domain for email registration

Improve this question
7
  • 1
    I'd consider rethinking the concept of "owning one's online identity". Email accounts are not an "identity". You use email to prove that you can access the email account. It's not a replacement or a proxy for an "identity".
    – schroeder ♦
    Commented Jul 30, 2021 at 7:11
  • @schroeder Which makes sense and I agree; it's the practical aspects that I'm pondering on. It seems most services treat email access as a key piece to proving identity; especially for recovery. Conceptually I am with you access to email is not identity - and in the future I hope we see wide-scale adoption of another form of authentication. My question is a based on the context of many important services requiring email/phone to sign up; and if there are ways to make that distinction clearer in my question, totally open to pointers.
    – user8187
    Commented Jul 30, 2021 at 12:46
  • 1
    So, then, your question is not about "identity" but about full control over your recovery options when email is the required control. Once you break down the question past the meta-layer, then the answer gets far clearer and less muddled: the fewer the parties involved in control over an asset (email providers, support teams, etc.), the more direct control over that asset. It's almost a tautology.
    – schroeder ♦
    Commented Jul 30, 2021 at 12:59
  • Oh I see; yeah when you say it like that, it seems I am tying together 'service-needs-proof-identity' and 'service-needs-proof-of-email-access'. Which I did that because so many services do that; but to your point, if we get to the root of the matter, it is the 'email is the required control.' (oops submitted to early; finishing now)
    – user8187
    Commented Jul 30, 2021 at 13:07
  • 1
    I see what you are getting at, but I think you are trying to add gravitas to the question. It's actually a pretty basic risk management or "business continuity" question in regards to email account recovery. Yes, running your own email server gives you more direct control, but greater responsibility, too. One option is to use an email service with a recovery approach that matches your needs, or forward all email from the main service to a backup service on another provider. But, everything has a trade-off.
    – schroeder ♦
    Commented Jul 30, 2021 at 14:05

1 Answer 1

Reset to default
0

After the comment exchange (major kudos to @schroeder) & thinking about this, I don't think my question is very answerable on this community. (See conclusion) So I intend on wrapping this up with this self-answer. (And if it'd be better to close or even delete the question, I'm fine with that)

In summary:

  • My question does boil down to "how to control the email account"; my question started a layer higher with identity, but most online accounts don't ask for identity - but rather control of email.
  • Which is just business continuity; a simple concept that an organization with personal & resources can do; but in terms of practicality for an individual, self-hosting email is not trivial; and I was hoping for more better options.
  • There are concepts/technologies that can address this or the layer above, but aren't yet implemented or widely available (see prior art).

Conclusion: I had hoped that this question might turn into a don't do 'X' do 'Y'; in the same way a person might recommend 2FA over just password. But after some thought, the only next steps I see are finding implementations or email-providers; and because this community does not do software/product recommendations, I believe this question has come to its end here.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .