Why don’t we do email verification in reverse?

Basic and easy internet precautions are not "register and run a domain and host your mail yourself". Basic and easy precautions are don't reuse passwords/use a password manager, use a reputable email provider, enable 2fa with totp, and dont click links from your emails

> first you need to somehow believe that no one is targeted by these schemes.

I don't see how you come to that conclusion at all. The assumption is that _everyone_ is targeted by those schemes.

> But somehow there's a whole international industry that thrives on stuff like Western Union transfers. Why is that?

Because they're low risk high reward, easy to set up, and you only need to make one mistake.

"There is no way around it" is such b.s., yes there is, pretend email does not exist, how would you do it? I think you skipped over parts of my post, there is a myriad of messaging applications if you insist control over some external account is the way to go. But really, the ideal way to do this would be have two sets of registration time challenges set. You can go with secret questions but also picture/emoji combinations, pins,patterns as the firsr piece and a second would either be a payment card for $0.01 charge or have them print one-time codes at registration time (second challenge skipped if second-factor auth is good).

"I refuse to change" is what you are saying, you can think about this longer than a minute and come up with more and better ways than what I just mentioned. Not only is email based password reser unneccesary, it is dangerous and lazy.

i'm not talking about unselecting all other types of communication, but rather having the service store 2 different emails for you. one for logging in and one for communication.

And the article also ignores the problems with the mailto:// link. cmon. The solution likely has more issues than the problem it solves.

No. In one case the proof is "the user receives E-Mails under this address" and in the other it is "the user can send E-Mails under this address".

The service is generally interested in proving the first. For recovery, service-related notifications and for unsolicited marketing. So all the things mentioned in making the "normal" flow undesirable, are actually exactly what the service owner wants to protect against. If their E-Mails don't get to you because they end up in spam or just get dropped by a misconfigured Mailserver, they can't spam you and you won't be able to use this account for recovery.

I agree that the reverse flow is easier (though TBF, mailto links also require the user to have set them up to work, which not all users have on all their devices). But I don't think that's where the incentives align.