2FA using a postcard

Google uses a postal-card OTP for Google MyBusiness service, to verify address for business listings. That is how you create Google Maps and Google Plus pages https://business.google.com). They again re-verification if the business address changes.

I think it is a very smart & less cumbersome way to verify physical address.

I agree with the comment that the email hint is totally unnecessary, and the ambiguous 3 day expiry window is too confusing in an world where post might take 1 - 2 days to arrive. Additionally the postcard aspect means people at every point along the delivery chain can read the back and front, why not just send a letter?

As a side note, I really like the way the author of this blog has constructed his "Contact Me" bit at the bottom, it's very intuitive, clever, and uses URI schemes where appropriate, nice job!

> This is a nifty way to lightly verify someone's address! A service could ask for scans of utility bills, or driving licences, but this is a lot simpler.

It's also an invalid way to verify where someone lives. It's possible to "verify" any address at which you can have mail sent to your name and receive, for example, a previous address, an office, a co-working space, an abandoned building or vacant apartment, etc.

This is why it's such a big deal that Nextdoor makes each user's address public inside their neighborhood group by default — there are trivial ways to get into a neighborhood group.

The Danish national identity system uses a code card as the second factor.

Picture of a card: http://2.bp.blogspot.com/-bhasaP2UfVA/T-itxSP6-uI/AAAAAAAAAF...

Site: http://NemID.nu

I had a Japanese site verify my address by sending me a postcard by registered mail. If the postcard got delivered they presumed the address was valid, if the post office failed to deliver they knew it was fake. No need for any action on the user's end.

When they Swedish post office started their online portal back in the mid-to-late 90's they would mail your initial password home when you signed up. I guess because postal mail is all they knew?

If anyone is looking for a fun side-project, this sort of postal verification could be part of bootstrapping a citizen-controlled national digital identity system. The system would also leverage the official gov election form that checks if you're registered to vote, resurfaced with an API.

This approach has the interesting property that, in order to cheat this unofficial system, you've have to commit either mail fraud (interception) or vote fraud (fake entry in election registry).

Canadian proof-of-concept here: https://github.com/patcon/id.c4nada.ca

Ping me on Twitter if you're interested in working on this in Canada or any other jurisdiction. Would be rad to create an auth system for citizen projects to validate identity/ward/district/state with high assurance. That way, user desires can be passed to reps with reasonable certainty that numbers reflect real voters.

And could start doing fun stuff with encryption keys or keybase integration or things like that ;)

How about verifying against the national identity database. No need to second guess identity / address, etc. Isn't that exactly why we've got strong identity, that it's very easy to validate it. I wonder why some services use all kind of pseudo methods, when there are strong and proven methods available. Also postcard is bad, because it's not registered mail, where recipient identity is verified. Some businesses do use that. But it's still worse than using online id. Because it's still more likely that the identity verification when receiving mail, isn't done properly.

American Radio Relay League (ARRL) employs postcard based recipient verification for amateur radio operators by mailing to their registered license address with FCC, a public record. They use this to sign a user certificate (X.509) which presently can be used to access Logbook of the World (LoTW), a web based logbook for radio operators to record contact with other operators.

Couchsurfing uses the same address verification method (postcard sent to your home with a code). That one is powered by Lob. Maybe this one is as well?

How is this a 2FA?

I've seen posters in the streets from one of the hyper-local social networks that have a per neighborhood code on the poster. You use that code to sign up for your neighborhood.

Denmark already does postcard 2FA called NemID for all its citizens

ricardo.ch (similar to craigslist) is doing the same in Switzerland. I think this gives the user the impression that he has to be responsible about his actions on the website.