How do I verify someone's identity if the only method of contact is their email address?

Question

Email addresses can be hacked or perhaps even spoofed. I need to pay individuals via paypal and I fear that over time people's email will change or become compromised. How can I ensure I am paying the right individual?

If I ask them to give me a personal password and in return I give them each a unique public key, will that be enough to verify their identity assuming they took precautions to remove the email with the public key and place the key in a secure place?

The target audience will likely be people who have no idea what gpg is. And some would want to remain anonymous. And others would not want to give their mobile number.

Alternatively, is there a there a website that could handle all of this?

Another point on the importance of the question: A thief is one thing, it will annoy me and perhaps even hurt my feelings and rob the intended individual. But there's a more serious threat. If you've paid any attention to the news over the last few years there are certain "people" bent on "causing terror". If it fell into their hands it would put lives at risk. I certainly don't want to be party to that.

Answer 1

"Remaining anonymous" and "verifying identity" are contradictory, aren't they? I would say if you want to pay someone and guarantee that they get the money, they can't remain anonymous.

If I ask them to give me a personal password and in return I give them each a unique public key, will that be enough to verify their identity assuming they took precautions to remove the email with the public key and place the key in a secure place?

I see a few problems that might come up:

1. how would they give you the personal password if not by email? I guess you should better describe where you are starting from with them.

2. deleting the email immediately does not guarantee safety. Compromised email accounts can be set up to forward emails to other accounts.

Usually what you want to achieve is done by communicating the "key" in an out-of-band method such as SMS. Those who don't want to divulge their number will just have to take the risk of losing their money, I guess.

If it fell into their hands it would put lives at risk.

That escalated quickly... you will have to explain more the threat you are really guarding against if you want a more helpful answer!

Answer 2

You can prove that someone owns an email address quite easily. You send them an email containing a random code, and ask the user to enter the code to confirm their email address. This is a very common technique for online signups, and the secret code is usually hidden inside a link, which the user has to click to confirm.

As you have identified, there are limitations to this technique. For example, if their email has been hacked, the hacker can confirm the email. Most websites do nothing to mitigate that; they simply require users to keep their email addresses secure. BTW, email spoofing is usually not an issue in this context, as the email address is used for sending emails.

If you need more security than this, you need to use channels other than email. You could ask for a phone number and send an SMS with a random code. Many major webmail providers (e.g. gmail) do this. Or ask for a postal address and send a physical letter with a random code. Postal verifications tend to only be done by financial organisations. You could even go all the way and tell the users to come into one of your offices with government issued ID, and verify them in person. You can also verify a Paypal address by asking for their postal address and verify this using an API that Paypal offer. All these options offer different levels of security, and come as different costs. You need to select an appropriate tradeoff based on how sensitive your application is.

I don't understand your final comment about putting lives at risk. Could you explain a little more about how your web site is likely to put lives at risk? If it really is that critical, you need to take expert advice beyond what Security Stack Exchange can offer.

Answer 3

It all boils down to trust and the competence of the parties involved. If you send them a password(i.e. shared secret) and the recipients forget to delete it and remains in the inbox then any attacker with access to that account may claim to be the indented recipient and will also be able to perform valid transactions.

You could use an escrow service for better security.

Answer 4

Sometimes learning ahead of time is the best solution. Decide on the limits that your adversaries are placed under then make an attempt to use secure methods that will exceed the limits that are on your adversaries. At some point holding an exchanged secret is what a paypal transfer relies on. You can voluntarily transfer funds from your account to theirs or they can email you a request for funds. Now the problem arises if an attacker gains access to the paypal account or the email address or both. Paypal has implemented two factor identification making it much harder to attack. Several email providers have also. Outside of learning to use GPG those are your best options.