Is it possible to do two-factor verification (email, text, let's say) using ethereum?

Question

One of the values of a trusted, centralized authority is that it can use two-factor authentication to establish a permission to do a given action.

Is it known whether an ethereum smart contract can verify a user through a channel. Ideally, the following should be possible (let's say for email):

(1) A secret is passed through email to the user seeking a permission. (2) The user signs a receipt to prove that the secret was received. (3) The receipt proves that the intended user received the secret.

The problem with this approach is that it does not prove that the channel was used. It is quite possible that the secret was passed to the user outside of the channel.

Proving that the email was sent is not sufficient because it must be proved that the secret or receipt was uniquely related to the email. It is necessary, as far as I understand it, to show that the secret could only have been sent through the channel. I am not clear how this could be proven.

Is there a known way to verify a user received a secret through an email or through a text?

Answer 1

The Ethereum network is mostly a bubble technically speaking in terms of how data moves. In order to get any non Ethereum data on chain, you need oracles. Its kind of like an island. There are decentralized oracle networks such as chainlink and tellor that assist with that, although those are not strictly on ethereum, they are their own networks.

In regards to email, as you said its a problem to verify the secret was actually sent through email. I'm not really sure you would go about trying to do something like this in a trustless decentralized way. Perhaps some email node could post some sort of proof that an email was sent. That doesn't stop that node from also sending that data also though a side channel to someone else though. Maybe if you had a bunch of nodes sending many emails and posting proofs, you could start to rely on the fact that not all of them cheated at the same time, if the final secret was reconstructed through many emails. But that is also a completely terrible user experience. I'm not sure if it would be possible to have a bunch of nodes partially construct an email, or some email client that assembles many special email messages from different decentralized nodes into one email to contain the final secret, then maybe you could technically do something like this.

It hasn't really been attempted, but that is an interesting though experiment I think. There also might be some other stuff I haven't considered like zero knowledge proof and the like, but these are some of the rambling thoughts off the top of my head about that problem.

Even so, if you were to build something like that, it would be be strictly Ethereum, but maybe there is some system you could build that accomplishes your overall goal of a decentralized trustless two factor system.