The "email is authentication" pattern

RealID requirement for domestic flights (still) isn't happening, just like it hasn't happened since it was first announced for requirement in 2008.

A lot of email reputation at this point, in fact I'd say most of it, is FUD. Here is a current example I am a hostage of:

Sys4 (an ESP) uses Abusix as a reputation service. Because this is poorly thought out (I've been a member of the mailing list for many years) I can't unsubscribe from the postfix-users@ mailing list (can't post either). Ok that's weird and funny in a way. We could talk about Sys4's procedural failures which go into it but we would be here all day.

I did Abusix's PYLM and they unblocked me, only to eventually block me again; that's when I found out I couldn't unsubscribe. I could PYLM again but I don't care. But that gave them an email address in the domain that they block. Do you see where this is going yet? I promise you there will be a twist at the end!

Funny thing is, I can send email to support@. Well, ok, so I think it's probably good that they don't subject their support channel to their dog food, because third parties reporting vulnerabilities is a trope in cybersecurity.

Aaand, here we go. So last week they sent UCE to that email address. That's right: they sent a marketing email to a domain that they block. I did not check any boxes "please, I'm a hostage, send me your marketing info and saaaave meeeee!" when I was talking to their support about what I could provide to my ISP. No boxes are checked now either, I verified this.

So, I responded to that email and said I'd be delighted to learn more about their product, please have Sales contact me. The marketing SPAM came from support@, the reply from Sales came from a person's email. Now we're no longer talking about that hypothetically exempt support@ channel, we're talking about corporate infrastructure. If their dog food is so good:

* Why is corp accepting email from a domain they block?

* Why is Sales sending email to a domain they block?

Here's the twist I promised you:

Do a DNS lookup for their MX: it's Google! They don't eat their own dog food, at all! Google has no problem with my domain; that's a general observation. If Google doesn't use their reputation service, why should you?

For the skeptical: http://athena.m3047.net/pub/soe/abusix-spam-backstory.html

My call with their Sales department is tomorrow morning; should be good times.

I agree, for personal use cases, RFC standard TOTP that can be backed up and managed by the user is the ideal balance of security and availability.

Enterprise TOTP apps like Okta and MS Authenticator have some enhancements. Push notifications are convenient when you have to access things many times a day. More importantly, push notifications with a number-matching confirmation reduces the chance of TOTP poaching, since the user themselves are interacting with the service requiring auth.

In enterprise environments, there should be a restore process for a lost phone or authenticator. Some kind of backup code with voice/manager approval, or coming into a physical office to reset credentials. This isn't available for regular people/regular retail services except maybe banks, but banks can't even do regular TOTP correctly.

"Mom, I already told you: you have to generate a key pair, split the private key into three parts using Shamir' secret sharing algorithm, then give each part to three banks. Whenever you want to use it, you have to go collect it from each of those banks---but DON'T write it down anywhere---and perform your transaction"

And to think the conversation started with an observation that people can't even remember one password.

> [...] the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. Humans need to be able to recover from their mistakes.

Maybe it's my memory playing tricks, or I've only seen the good articles, but I believe nearly every single article about setting up a self-managed crypto wallet had stressed out the importance of having a backup. Serious ones had even explained the 3-2-1 rule. Then the hype came, with it came scams and pumps-and-dumps and NFTs and whatever, and crypto became a clusterfuck that a lot of people didn't want to touch. Yuck.

That's probably the one thing cryptocurrency communities undeniably got right. Quite unlike the Passkeys, where I've yet to see any official or semi-official demo site that even has a flow for adding a second token (some actual sites do, but not the demos).

We should start teaching basic backup strategies in schools. It's not some advanced rocket science, and it's a knowledge that's useful to anyone who deals with information (that is, literally anyone participating in the modern society).

Also, this user unfriendliness is extremely temporary, because computers and Internet are new (at the scale of societies), and there are plenty of folks who had only started to use them later in their lives. After you lose some file or account (ideally, as a kid, so it's not something serious) you start to understand the old adage about those whose do backups and those who don't do them _yet_.