2FA using a postcard

https://shkspr.mobi/blog/2017/06/2fa-using-a-postcard/

by edent • 9 years ago

71 36 9 years ago

How about verifying against the national identity database. No need to second guess identity / address, etc. Isn't that exactly why we've got strong identity, that it's very easy to validate it. I wonder why some services use all kind of pseudo methods, when there are strong and proven methods available. Also postcard is bad, because it's not registered mail, where recipient identity is verified. Some businesses do use that. But it's still worse than using online id. Because it's still more likely that the identity verification when receiving mail, isn't done properly.

djhworld2• 9 years ago

The UK doesn't have a national identity database.

kpil2• 9 years ago

Is that for any particular reason?

There has been a national identity register here since 400 years, so I might be a bit biased, but I never really saw a problem in everyone knowing where other people live.

The most common problem is you have an abusive ex-husband, and some similar things like that, but then the national identity database is just a very minor side-problem compared to the actual problems...

nly• 9 years ago

The defacto databases for residency are those held by the UKs 3 main credit reference agencies, who all have access to the electoral roll and offer address verification as a service.

e.g. http://www.experian.co.uk/business-express/identity-solution...

edent2• 9 years ago

The UK has no identity database.

There was an option to verify by phone number - but it didn't work on my mobile. I assume that they use landline numbers to see if you are in the right geographic area.

denzil_correa• 9 years ago

Isn't that exactly why we've got strong identity, that it's very easy to validate it

It is also easy to lose your privacy.

http://www.lse.ac.uk/management/research/identityproject/

jwilk• 9 years ago

How is this a 2FA?

yladiz• 9 years ago

Because it's a second factor beyond your password.

dchest• 9 years ago

This is just address verification using a mailed-in code. 2FA term describes a system that uses a second factor for authentication. This one uses a code sent by mail for registration (where first authentication is part of the registration).

djhworld2• 9 years ago

I agree with the comment that the email hint is totally unnecessary, and the ambiguous 3 day expiry window is too confusing in an world where post might take 1 - 2 days to arrive. Additionally the postcard aspect means people at every point along the delivery chain can read the back and front, why not just send a letter?

As a side note, I really like the way the author of this blog has constructed his "Contact Me" bit at the bottom, it's very intuitive, clever, and uses URI schemes where appropriate, nice job!

firloop• 9 years ago

I think it's likely that it probably doesn't expire, or has an expiry longer than 3 days; saying that the code expires gives a sense of urgency. I'm sure it helps with conversion, as this is yet another step of the onboarding process.

TeMPOraL• 9 years ago

saying that the code expires gives a sense of urgency

It also is, quite literally, lying to people. I personally hate when businesses do that.

petee• 9 years ago

Infact, a comment left below says exactly that - it was forgotten in a vehicle for a few weeks and it still worked

edent2• 9 years ago

Thanks! You can read about how I built the contact me page at https://shkspr.mobi/blog/2017/04/how-i-built-a-responsive-se...

viral_krieger• 9 years ago

Under 16KB and no javascript, fantastic.

SingAlong• 9 years ago

Google uses a postal-card OTP for Google MyBusiness service, to verify address for business listings. That is how you create Google Maps and Google Plus pages https://business.google.com). They again re-verification if the business address changes.

I think it is a very smart & less cumbersome way to verify physical address.

janklimo• 9 years ago

Couchsurfing uses the same address verification method (postcard sent to your home with a code). That one is powered by Lob. Maybe this one is as well?

Symbiote3• 9 years ago

The Danish national identity system uses a code card as the second factor.

Picture of a card: http://2.bp.blogspot.com/-bhasaP2UfVA/T-itxSP6-uI/AAAAAAAAAF...

Site: http://NemID.nu

raverbashing• 9 years ago

Yes

For some reason Germans love these cards as well

fulafel• 9 years ago

Also known as one time passwords. These are great and way underused.

weinzierl• 9 years ago

I've seen posters in the streets from one of the hyper-local social networks that have a per neighborhood code on the poster. You use that code to sign up for your neighborhood.

kalleboo• 9 years ago

I had a Japanese site verify my address by sending me a postcard by registered mail. If the postcard got delivered they presumed the address was valid, if the post office failed to deliver they knew it was fake. No need for any action on the user's end.

When they Swedish post office started their online portal back in the mid-to-late 90's they would mail your initial password home when you signed up. I guess because postal mail is all they knew?

syndev• 9 years ago

For the Japanese service, did anything prevent users from putting an address that received mail, but wasn't theirs?

ciucanu• 9 years ago

ricardo.ch (similar to craigslist) is doing the same in Switzerland. I think this gives the user the impression that he has to be responsible about his actions on the website.

chinathrow• 9 years ago

More that it weeds out all the scammers hiding behind fake adresses.

tedmiston• 9 years ago

This is a nifty way to lightly verify someone's address! A service could ask for scans of utility bills, or driving licences, but this is a lot simpler.

It's also an invalid way to verify where someone lives. It's possible to "verify" any address at which you can have mail sent to your name and receive, for example, a previous address, an office, a co-working space, an abandoned building or vacant apartment, etc.

This is why it's such a big deal that Nextdoor makes each user's address public inside their neighborhood group by default — there are trivial ways to get into a neighborhood group.

patcon• 9 years ago

If anyone is looking for a fun side-project, this sort of postal verification could be part of bootstrapping a citizen-controlled national digital identity system. The system would also leverage the official gov election form that checks if you're registered to vote, resurfaced with an API.

This approach has the interesting property that, in order to cheat this unofficial system, you've have to commit either mail fraud (interception) or vote fraud (fake entry in election registry).

Canadian proof-of-concept here: https://github.com/patcon/id.c4nada.ca

Ping me on Twitter if you're interested in working on this in Canada or any other jurisdiction. Would be rad to create an auth system for citizen projects to validate identity/ward/district/state with high assurance. That way, user desires can be passed to reps with reasonable certainty that numbers reflect real voters.

And could start doing fun stuff with encryption keys or keybase integration or things like that ;)

zubairq3• 9 years ago

We already do this in Denmark and the company is looking to USA too

zubairq3• 9 years ago

Denmark already does postcard 2FA called NemID for all its citizens

abricot• 9 years ago

But the price/speed of mailing in DK puts the method out of grasp for most organizations.

zubairq3• 9 years ago

They get over this by mailing 100 at a time

bdd• 9 years ago

American Radio Relay League (ARRL) employs postcard based recipient verification for amateur radio operators by mailing to their registered license address with FCC, a public record. They use this to sign a user certificate (X.509) which presently can be used to access Logbook of the World (LoTW), a web based logbook for radio operators to record contact with other operators.

2FA using a postcard

Related Stories