Ask HN: Would you use an email service that can only be reset in person?

I already have an unreasonable dislike for online services that have lengthy/complex password reset processes. Being forced to show up somewhere IRL to reset my password sounds like a fever dream to me.

Put another way, what does "security through obscurity" refer to? Why do we only use cryptographic methods that are totally explained, rather than those that keep their procedure secret?

If a password is compromised / brute forcedthe attacker will have access to the victim's e-mail (or other data) until the victim makes the time to get around to resetting the password in person, which might take a while.

Online IAM is hard.

My country offers several national digital identification services and if you can use one of those for password recovery, well that's a feature I would find interesting with my existing mail provider.

I'm sceptical that it would provide much more security. Do you have the skills or technology to validate physical identification (drivers' licences, passports)?

What happens if somebody has lost their laptop and identification (fire, flood, theft etc)? They don't remember their password, and they are having a difficult time proving who they are?

How are you planning on dealing with people who are angry, aggressive or even violent?

What if somebody shows up armed and threatens your staff?

I like that idea. I could see something like this being partnered with brick-and-mortar banks or grocery chains. Many banks already deal with validating ID's and in some cases have free or discounted notary services for their customers. Or at least some national / international chain store. Some grocery stores already partner with banks and have a bank in a percentage of their grocery stores. I'm in the middle of nowhere but my near-by town has a bank and a grocery store.

The more I think about it, this would be more useful and scalable if it were not strictly an email service but rather an identity provider. Think SAML/Oauth provider that is highly extensible to email providers, app providers, SaaS /misc cloud providers, etc... A distributed LDAP managed by banks or grocery stores with simple and secure web front-end API's. By distributed I mean highly fault tolerant active-active in many regions and with many hourly backups in every region. LDAP can store email addresses, aliases, phone numbers and more. The management API would have to contain a distributed and highly detailed journal of who changed what, using some type of cryptographic proof.

If a person changes their email provider, app provider, cell phone provider, or anything else for that matter... then their identity follows them. They would already have in place that which they wish to share publicly and that which companies can use privately to ID them.

With retail on the way out, and lots of open space

I not so sure about the idea of picking up unused buildings. That would be a monumental cost for a single service and probably quite challenging to get funding for. Real-estate is a good investment but comes with a high burn rate insurance, maintenance, security, code compliance, etc... I think this aspect would require a remarkable business plan for investors to not be highly skeptical.

It was high friction by design. It only worked well because 98% of the entire user base lived within two miles of the IT office—and the amount of rage generated when a professor on sabbatical had to come back to campus just to reset their password was a sight to see.

If there are just a few physical locations where the reset can occur, nobody who lives far from those locations can reasonably use the service. The risk is too great.

If there are lots of physical locations, then the whole purpose of the service is defeated. There's no way to control the people working at all those locations, and surely some of them will become compromised.

I think the only solution is to somehow integrate with something like a bank or post office that seem to have already solved the problem of operating many secure retail locations.

And what would this checklist entail? How would a random store employee be able to verify my identity?

[Edit to Update]: It also strikes me as an excellent water-hole attack vector.... Attacker triggers a password reset and then just waits for you to show up to reset location and bam! you got your man or you can tail him back to his home and get them there. Useful against both bad guys and people with large cold wallets. Ouch (in more ways than one) but see my point above about differing threat models.

BUT: The devil is in the details. How far will I need to travel to reset my email password? How diligent will the people be in verifying that I'm who I claim I am? How easy will it be to impersonate me and take over my account?

Personally, I think something like this needs to gravitate towards a government service.

Maybe if that email service was run by usps or something I would consider it.

For example, Facebook started where people needed a university-validated email address to join. This allowed there to be a one-to-one matching of account and human. While there are some ways to do KYC online, I imagine an in-person solution might help a LOT. It couid still be tied to an email address, if you wanted, as it can be easy for sites to restrict login to specific email domains. I just think for me, what I want the most as a user and especially as a site designer, is a way to more confidently prove someone's identity or at least their humanness.

Everyone here either loves or hates the core idea (the core idea not the details), but it's a safe difference not religion or guns etc. People on opposite sides merely think the others are crazy or stupid not evil or inhuman.

One thing I've observed; Of the people who like the idea, they often have alterations or improvements to suggest to address various facets of it. They say "the idea is good but there is a problem and maybe that can be addressed this way ...". Of the people who don't like it, few/none are criticizing any specific facets or suggesting ways to address them to still get the core ideas' safety benefit, nor explain how the core stated benefit is not needed because you get it some other better way. They only say "god no, why? no way"