> The information accessed is not sufficient to make fraudulent charges on your payment card. In other words... "We leaked a bunch of your personal information, but at least it's not enough data to steal your money!" All of these leaks have the cumulative effect of making ineffective very commonly used security verification questions: "Can I verify that last 4 of your social? And the last 4 of your credit card?" How…
Hell, imagine how many scans of people’s passports and driver’s licenses are sitting in databases waiting to be leaked, yet images of those documents let you authenticate with all sorts of financial institutions online from banks to Coinbase to Paypal. We really need to rethink all this. Until then, it feels like mere luck that today wasn’t the day someone decided to social engineer their way into your life. Everythi…
At the top, we'd have in-person verification using physical documents, such as passport, driver's license, birth certificate, and similar. A good candidate to handle this level is banks and credit unions, at their branch offices.
To handle people who can't come in in-person to set up their account at a top level verification service, there could be top level providers that send a notary to you to check your documents.
Online access to top level accounts should require 2FA. Account recovery in the case of lost passwords or lost second factor or lost recovery codes would require another in-person verification.
Next down in the hierarchy would be services like email providers. When you set up your account with them, you should be able to associate it with one of your accounts at a top level provider, and there should be a way for the email provider to verify with the top level provider and with you that you really are the owner of that top level account.
Account recovery for these accounts requires re-verifying with the associated top level provider.
Below that are services that use your email address as your identity. They verify you the usual way--sending an email and requiring you to prove that you received it. Account recovery requires the same kind of verification.
The idea is that everything is ultimately rooted with your top level providers. If you can protect those accounts, then everything below has protection. Someone might still temporarily hijack your Twitter account or even your email account, if you aren't using strong 2FA and your password leaks, but you can do an account recovery using the account that is above it in the identity hierarchy.
For banks that serve as top level verification services, this should be separate from online banking accounts. People need to routinely log into online banking, but should only very rarely need to use their verification account. The verification account generally only needs to be used when creating a new account one step down the hierarchy, such as a new primary email account or a new account at a domain registrar, or when recovering a lost or hijacked email or domain account.
It should thus be feasible to not store your top level password online at all. It can be on a printed document kept where you store other important documents, such as in your fire proof safe with your passport and birth certificate.
On another topic--sites really should clearly document how things like account recovery works. If a site that requires 2FA for login allows configuring whether that is via SMS, TOTP, or U2F...but then it turns out that you can always do account recovery via SMS even if you disabled that as a 2FA method for login, I want to know that up front, so that I know that switching to TOTP or U2F doesn't actually protect me against account theft. At many sites, the only way to actually find out how account recovery works is to go through it, and that is annoying.