I like the idea of Wikipedia's
#CommittedIdentity (see:
https://meta.wikimedia.org/wiki/Template:User_committed_identity ).
You can prove you are who you claim you are by revealing to the trusted third-party the text you
#sha512 hashed. This allows them to hash it themselves and compare if it matches the hash you provided.
I think this can also be implemented in other services as a last resort. Here's a scenario:
1. Your account was compromised
2. The unauthorised user changed your password and account details. Probably also invalidated your
#TwoFactorAuthentication (they gained access because you saved your
#2FA, and it was compromised).
3. In the gaming industry, we can help you by asking old information only you can know. Outside the gaming industry, it is not an option, for example, small services like
#Fediverse instances.
4. However, the said service allows one to enter a “Committed Identity” hash. This information, once entered, can never be changed, and it is hidden (only viewable by the admins). Because of this, the unauthorised user can never change it (unless it's an inside job).
5. You, the original owner, can proceed with verification. The said service will be able to verify your ownership, add your email back, and send you a password reset link.
6. The service will then invalidate the committed identity hash, however, it will remain on record, still hidden.
7. After recovering your account, you have to set a new committed identity hash.
8. You have to remember your previous hash, as the service can ask what was your old hash, as another form of verification. (Which only you should ever have knowledge of.)
Q: What if I want to update my committed identity hash?
A: You will have to contact the service customer support because it is only them who can invalidate it.
The first step they will do is ask you for your secret, or the text you hashed with sha512. If it matches, then they can invalidate it and let you set a new one.
Q: How can I create a hash?
A: WikiMedia / Wikipedia is using this online tool:
https://ftools.toolforge.org/general/text2hash.html if you are not a techie.
---
At least that's the basic idea.
Found the “Committed identity” via
@boud 's Wikipedia profile.
#Security #Verification #Identiy