Possible ways of verifying the ownership of Ethereum address when user lost its private key?

Question

I am working on something that relates the ownership of the ethereum account address. I have a situation depicted as follows:

Someone issues a token and issuer KYCed(off-chain) my ethereum account address, So I am able to hold or buy the tokens from the crowdsale. But somehow I lost the private key of my wallet now I am not able to access my account, I quickly contact to my token issuer which has some backdoor mechanism (Not known for now but let's predict issuer has some magic) to transfer those tokens from my previous account to new account but the problem now for token holder is to verify the ownership of its lost account.

So what will be the feasible ways to prove the ownership of the address?.

I know this is something a researched base question but I really want the inputs to formalize the idea.

Any inputs are appreciable.

Answer 1

So what will be the feasible ways to prove the ownership of the address?.

The only way of verifying ownership of an address is the private key. If you don't know the private key you don't own the address. If you somehow 'lose' the private key you lose ownership of the address.

There is no way of verifying that they did own the address unless you put some verification mechanism in place before they 'lost' their private key.

You could for example have a second contract which stores a mapping of addresses => signed messages whereby the signed message is a message signed with a secret that only the user knows.

Parts of the ENS contracts work on the premise of secrets whereby only the user submitting the hash knows the secret and can thus validate the authenticity of the signature at a later date.

The problem is that if your user 'lost' their private key they will probably also forget their secret. Furthermore getting people to sign a message is another onboarding hoop that perhaps your users won't want to go to the effort of completing.

Basically. Your users should just not lose their private keys.

Answer 2

Some backdoor mechanism (not known for now but let's predict issuer has some magic) to transfer those tokens from my previous account to a new account:

There's no magic here.

On the issuer's contract, your account is simply mapped to the amount of tokens given to you.

If you can persuade the issuer to transfer them from this account to your new account, then the issuer will only need to map your new account to the same amount, and then map your previous account to zero.

Something like:

balances[newAccount] = balances[oldAccount];
balances[oldAccount] = 0;

Take a look at StandardToken contract by OpenZeppelin.

---

With regards to the actual question and hand:

After KYCing you, the issuer will have to store all your personal information (used in the KYC process) alongside your wallet.

But while this will be sufficient for allowing a user to replace his or her account, it will also pose a serious risk of their personal information leaking to the public.

Ideally, you would want your personal information to be completely deleted after the KYC process is complete.

This is probably not going to happen, but as a compromise, those details should by the least not be stored on the issuer's off-chain servers, and remain only on the servers of the third-party company who has conducted the KYC.