IMHO, it should be out-of-bound 2FA, involving a smartphone (yes, I know that it’s not socially inclusive, and that’s a good point in some cases…) – the only form factor which we are likely to guard closely (and even then not immune to hacking).

More cumbersome option is a cloud-connected OTP token (to prevent RSA-style seed cracking disasters) coupled with, again, out-of-bound login. Easily deployable (sort of), and a major step forward compared to the current status quo.

Neither the banks nor the telcos would grasp the opportunity then and they still won’t.

That must tell us something.

The benefits aren’t as great as everyone else (apart from the banks and the telcos) imagines? Mistakes could have existential consequences for the company concerned.

The costs are a lot higher than everyone else imagines? Running a national identity management scheme doesn’t come cheap.