10 ms·

Amazon Is Asking Indians to Hand Over Their Aadhaar Biometric ID

140 points by kmfrk 9y ago

ganeshkrishnan 9y ago
The slippery for aadhar card is on full display here. Few years back when this biometric identity card was introduced the government promised not to make it mandatory and now your cannot even shop online without this card.
- nerpderp83 9y ago
  TIL that slopes, positive or negative also need to account for the wind vector and the friction. Low friction and prevailing wind can allow one to slide uphill. It isn't the slope per-se but the energy in the system.
- CamelCaseName 9y ago
  That's disappointing. At least it sounds like an interesting edge that Indian shopping services can use to attract privacy conscious consumers... until the government requires its use everywhere.
- thevardanian 9y ago
  If I'm being honest I would much rather have the government use something like a public biometric ID number that uses biometrics to validate the number rather than a broken SSN. I mean we already give our fingerprints to the DMV, and to the Customs/Immigration desk when coming back from an international flight. In today's world not only is SSN vital to everyday life, it is also ironically one of the least secure means to establish ID. Having your SSN out in the public is potential financial ruin, and we generally need to hand out that number to various private organization, and individuals. And if the Equifax leaks are any indication SSNs are the weakest link in society.
  - StanislavPetrov 9y ago
    >I mean we already give our fingerprints to the DMV, and to the Customs/Immigration desk when coming back from an international flight. I'm not sure what country you live in, but US citizens most certainly are not required to give their fingerprints to the DMV or Customs/Immigration when flying internationally.
    - dunham 9y ago
      Probably the country of California. (Or possibly Colorado, Georgia, or Texas - according to a quick google search.)
      - linkregister 9y ago
        Not CA, MD, or HI, where supposedly this sort of thing would happen.
        dunham 9y ago
        I recall my thumbprint being collected in CA (in the peninsula). It's been a few years. I remember it because I found it somewhat disturbing that they collected thumbprints. The CA DMV web site confirms this practice: "Fingerprints, including thumbprint, are collected by DMV for added security to your driver license information" -- https://www.dmv.ca.gov/portal/dmv/detail/dl/how_info_shared https://www.dmv.ca.gov/portal/dmv/detail/dl/how_info_shared If your experience is different (I may be misreading your response), maybe it varies by office or it's been a while since you've registered in a DMV office in CA?
        linkregister 9y ago
        I stand corrected, I didn't have mine collected in early 2015. It appears the policy has changed.
    - astura 9y ago
      There's more than 50 American DMVs, all the states plus DC and each of the territories have their own. Do you really think you know everything about all the requirements for an ID for all of them to make such a statement?
  - JumpCrisscross 9y ago
    I have never given Amazon my SSN.
  - pritambaral 9y ago
    > uses biometrics to validate the number Biometrics can be trusted only as far as one can trust the source of the biometric info being provided. If you're getting biometric info as digital images, you'd have to be sure the images came directly from the person, only for this validation, and (if you want to use this validation for authentication) voluntarily. The first two can be achieved only if the biometrics are given straight to the government's biometric verification authority, instead of whatever service needs to verify your id taking them and passing them on to the government. The latter is like giving your Facebook username and password to a third-party just so they can verify your Facebook account, the former is like an SSO service. I have not seen a single SSO-like implementation of biometric Aadhaar verification in India. And, of course, the third requirement cannot be fulfilled; biometrics are not passwords.
    - thevardanian 9y ago
      No. Biometrics aren't passwords. They're identification. Just as your picture identifies who you are. As for the later part I feel that, again, the DMV already takes our biometric data, and I would think the same could apply for people in India. Someone is issuing passports, someone has to create valid means of identification. I mean how else is the government dispensing welfare, social aid, or making sure they're accounting for taxes properly. Looking at how the Aadhar authentication process works indeed the biometric data is being validated by the government.
- hiyer 9y ago
  That's not true at all. You can buy anything shipped from within India without providing any documents. Amazon requires id/address proof only when the item is shipped from abroad, and that's only because customs requires it. And you have the options of: a) Providing the proof to the courier instead of amazon b) Providing a different address proof like voter id
kinkrtyavimoodh 9y ago
Some clarifying info, since the title is kinda clickbait—the AADHAAR card doesn't have any biometric info for it. It just has a number. The biometric info lies with the government who can then authenticate an individual based on it. This whole AADHAAR linking business has been a point of contention in India over the last year as the government is slowly mandating linking your AADHAAR number with all kinds of contracts and services, from rental contracts to telecom providers to bank accounts. If anyone deserves blame for this kerfuffle, it's the government.
- jsmthrowaway 9y ago
  Aadhaar is interesting to watch, given America's debate over using social security numbers for the same purpose, and how to replace that in the wake of Equifax. It seems like the winds are starting to align for us to have something like Aadhaar, so it's interesting to see Indian reaction to it. SSN for services is par for the course in the US. My cable company has mine.
  - Zak 9y ago
    > SSN for services is par for the course in the US. My cable company has mine. Which seems broken too. Why don't they just let you prepay for service such that they don't need any identity information?
    - jsmthrowaway 9y ago
      I 90% agree, with the 10% exception that most cable companies admit you to the Internet, so under current legal frameworks for handling stuff that genuinely shouldn't be on the Internet, a case can be made that they need to know who you are. Not saying that's right, saying it's probably best at the moment. Granted, they also have a service address, and the clever ones can proxy up, but...
      - jstanley 9y ago
        You state yourself that the ISP also has the service address, and it's also clear that everybody in the house is using the internet connection, not just the person who is paying the bill. So identifying the customer provides the ISP with neither the identity of the person using the internet connection, nor any more information (than the service address) about how to locate the person using the internet connection. So, even if you believe it is right and proper that ISPs are deputised to track down internet users on behalf of the government: why is it advantageous that they identify their customers?
dingo_bat 9y ago
Amazon is not asking for any biometrics. They are asking for your Adhaar number. The government has an authentication API that can confirm your identity for Amazon using the number. They can do this authentication by email, by phone, or by fingerprints. This whole FUD about Adhaar is really sad to see. It's a useful service and we desperately need a national ID. Until now different things require different IDs. Voting card, ration card, PAN card, Passport, Driving license, and so on. With Adhaar we finally have the chance to move to one unique ID for every citizen. Of course like everything done by government, there are inefficiencies and bureaucracy, but it's markedly less than what we face in other IDs.
- fractalb 9y ago
  I don't think it's FUD. I have a few questions. Can we confidently say that the database won't ever be hacked in the future? Are we prepared to face such situation? Would the government let you know if the database ever got hacked? What guarantees do we have that the politicians won't use it for their advantage?
  - dingo_bat 9y ago
    > Can we confidently say that the database won't ever be hacked in the future? No, that would be a ridiculous thing to be confident about. > Are we prepared to face such situation? I hope so. I have trust in this admin a bit more than previous ones. But long-term, I don't know. > Would the government let you know if the database ever got hacked? They are bound to respond to an RTI inquiry. > What guarantees do we have that the politicians won't use it for their advantage? None, just like anything else. Just the assurance that we all get to vote them out if we want.
    - lovelearning 9y ago
      > They are bound to respond to an RTI inquiry. Their past behaviour has not been good [1]. Trust is the whole problem. Many like you trust this government (why is something I can't understand, other than their effective propaganda, but let's leave it at that). But there are many who don't. It's not just about privacy, it's also about things like fear, religious profiling, autocratic tendencies, curbing of freedoms. It's also not about just the current government, but of governments to come. A non-mandatory aadhar would give those who don't trust the system a choice to remain out of its programmes and perhaps voluntarily pay higher costs or forego any benefits. But this government has not given any such choice. It's deeply discomforting to be forced to give all this information to an entity one doesn't trust. [1]: https://thewire.in/146791/uidai-invokes-national-security-reject-rti-query-fake-duplicate-aadhaar-cards/ https://thewire.in/146791/uidai-invokes-national-security-re...
hiyer 9y ago
Amazon only requires id when you order from Amazon Global, and that's because customs requires Indians to provide identity and address proof when you're importing something. If you don't want to provide it to Amazon, you have the option of providing it to the courier service (FedEx/Aramex/whatever). Also, you can provide any other address proof like driving license, electricity bill, voter id etc. Aadhaar is convenient because it is one of the few documents that are accepted as proof of both identity and address (passport, driving license, voter id and ration card are the others). So, yes, clickbait article.
- zeusk 9y ago
  This particular case is for investigation into a reportedly missing package of a mobile phone; but yes, clickbait.
- lightmaker 9y ago
  Did you actually read the article? This is more than for just global shopping.
- nileshtrivedi 9y ago
  Aadhaar is NOT a proof of address. Or Age. UIDAI has clarified it.
  - kinkrtyavimoodh 9y ago
    The Aadhaar card has your birth year on it. How is it not a proof of age within a maximum error of one year?
    - pritambaral 9y ago
      In quite many cases, a margin of error of one year is too large for age verification.
    - nileshtrivedi 9y ago
      They don't VERIFY the birth year. It is only as good as the other ID docs submitted to them. In their own words: https://twitter.com/UIDAI/status/934731727808774144 https://twitter.com/UIDAI/status/934731727808774144
deafcalculus 9y ago
The local newspaper reported that the state government is asking for Aadhaar when distributing free HIV medicine. That seems a lot more problematic.
jakeogh 9y ago
A ID number to buy stuff? I remember hearing about that somewhere. I think it was an old book? Someone should tell China, their life gamification score could benefit... ID theft and all.

140 points by kmfrk 9y ago

The slippery for aadhar card is on full display here. Few years back when this biometric identity card was introduced the government promised not to make it mandatory and now your cannot even shop online without this card.

nerpderp83 9y ago
TIL that slopes, positive or negative also need to account for the wind vector and the friction. Low friction and prevailing wind can allow one to slide uphill. It isn't the slope per-se but the energy in the system.
CamelCaseName 9y ago
That's disappointing. At least it sounds like an interesting edge that Indian shopping services can use to attract privacy conscious consumers... until the government requires its use everywhere.
thevardanian 9y ago
If I'm being honest I would much rather have the government use something like a public biometric ID number that uses biometrics to validate the number rather than a broken SSN. I mean we already give our fingerprints to the DMV, and to the Customs/Immigration desk when coming back from an international flight. In today's world not only is SSN vital to everyday life, it is also ironically one of the least secure means to establish ID. Having your SSN out in the public is potential financial ruin, and we generally need to hand out that number to various private organization, and individuals. And if the Equifax leaks are any indication SSNs are the weakest link in society.
- StanislavPetrov 9y ago
  >I mean we already give our fingerprints to the DMV, and to the Customs/Immigration desk when coming back from an international flight. I'm not sure what country you live in, but US citizens most certainly are not required to give their fingerprints to the DMV or Customs/Immigration when flying internationally.
  - dunham 9y ago
    Probably the country of California. (Or possibly Colorado, Georgia, or Texas - according to a quick google search.)
    - linkregister 9y ago
      Not CA, MD, or HI, where supposedly this sort of thing would happen.
      - dunham 9y ago
        I recall my thumbprint being collected in CA (in the peninsula). It's been a few years. I remember it because I found it somewhat disturbing that they collected thumbprints. The CA DMV web site confirms this practice: "Fingerprints, including thumbprint, are collected by DMV for added security to your driver license information" -- https://www.dmv.ca.gov/portal/dmv/detail/dl/how_info_shared https://www.dmv.ca.gov/portal/dmv/detail/dl/how_info_shared If your experience is different (I may be misreading your response), maybe it varies by office or it's been a while since you've registered in a DMV office in CA?
        linkregister 9y ago
        I stand corrected, I didn't have mine collected in early 2015. It appears the policy has changed.
  - astura 9y ago
    There's more than 50 American DMVs, all the states plus DC and each of the territories have their own. Do you really think you know everything about all the requirements for an ID for all of them to make such a statement?
- JumpCrisscross 9y ago
  I have never given Amazon my SSN.
- pritambaral 9y ago
  > uses biometrics to validate the number Biometrics can be trusted only as far as one can trust the source of the biometric info being provided. If you're getting biometric info as digital images, you'd have to be sure the images came directly from the person, only for this validation, and (if you want to use this validation for authentication) voluntarily. The first two can be achieved only if the biometrics are given straight to the government's biometric verification authority, instead of whatever service needs to verify your id taking them and passing them on to the government. The latter is like giving your Facebook username and password to a third-party just so they can verify your Facebook account, the former is like an SSO service. I have not seen a single SSO-like implementation of biometric Aadhaar verification in India. And, of course, the third requirement cannot be fulfilled; biometrics are not passwords.
  - thevardanian 9y ago
    No. Biometrics aren't passwords. They're identification. Just as your picture identifies who you are. As for the later part I feel that, again, the DMV already takes our biometric data, and I would think the same could apply for people in India. Someone is issuing passports, someone has to create valid means of identification. I mean how else is the government dispensing welfare, social aid, or making sure they're accounting for taxes properly. Looking at how the Aadhar authentication process works indeed the biometric data is being validated by the government.
hiyer 9y ago
That's not true at all. You can buy anything shipped from within India without providing any documents. Amazon requires id/address proof only when the item is shipped from abroad, and that's only because customs requires it. And you have the options of: a) Providing the proof to the courier instead of amazon b) Providing a different address proof like voter id

kinkrtyavimoodh 9y ago

Some clarifying info, since the title is kinda clickbait—the AADHAAR card doesn't have any biometric info for it. It just has a number. The biometric info lies with the government who can then authenticate an individual based on it. This whole AADHAAR linking business has been a point of contention in India over the last year as the government is slowly mandating linking your AADHAAR number with all kinds of contracts and services, from rental contracts to telecom providers to bank accounts. If anyone deserves blame for this kerfuffle, it's the government.

jsmthrowaway 9y ago
Aadhaar is interesting to watch, given America's debate over using social security numbers for the same purpose, and how to replace that in the wake of Equifax. It seems like the winds are starting to align for us to have something like Aadhaar, so it's interesting to see Indian reaction to it. SSN for services is par for the course in the US. My cable company has mine.
- Zak 9y ago
  > SSN for services is par for the course in the US. My cable company has mine. Which seems broken too. Why don't they just let you prepay for service such that they don't need any identity information?
  - jsmthrowaway 9y ago
    I 90% agree, with the 10% exception that most cable companies admit you to the Internet, so under current legal frameworks for handling stuff that genuinely shouldn't be on the Internet, a case can be made that they need to know who you are. Not saying that's right, saying it's probably best at the moment. Granted, they also have a service address, and the clever ones can proxy up, but...
    - jstanley 9y ago
      You state yourself that the ISP also has the service address, and it's also clear that everybody in the house is using the internet connection, not just the person who is paying the bill. So identifying the customer provides the ISP with neither the identity of the person using the internet connection, nor any more information (than the service address) about how to locate the person using the internet connection. So, even if you believe it is right and proper that ISPs are deputised to track down internet users on behalf of the government: why is it advantageous that they identify their customers?

dingo_bat 9y ago

Amazon is not asking for any biometrics. They are asking for your Adhaar number. The government has an authentication API that can confirm your identity for Amazon using the number. They can do this authentication by email, by phone, or by fingerprints. This whole FUD about Adhaar is really sad to see. It's a useful service and we desperately need a national ID. Until now different things require different IDs. Voting card, ration card, PAN card, Passport, Driving license, and so on. With Adhaar we finally have the chance to move to one unique ID for every citizen. Of course like everything done by government, there are inefficiencies and bureaucracy, but it's markedly less than what we face in other IDs.

fractalb 9y ago
I don't think it's FUD. I have a few questions. Can we confidently say that the database won't ever be hacked in the future? Are we prepared to face such situation? Would the government let you know if the database ever got hacked? What guarantees do we have that the politicians won't use it for their advantage?
- dingo_bat 9y ago
  > Can we confidently say that the database won't ever be hacked in the future? No, that would be a ridiculous thing to be confident about. > Are we prepared to face such situation? I hope so. I have trust in this admin a bit more than previous ones. But long-term, I don't know. > Would the government let you know if the database ever got hacked? They are bound to respond to an RTI inquiry. > What guarantees do we have that the politicians won't use it for their advantage? None, just like anything else. Just the assurance that we all get to vote them out if we want.
  - lovelearning 9y ago
    > They are bound to respond to an RTI inquiry. Their past behaviour has not been good [1]. Trust is the whole problem. Many like you trust this government (why is something I can't understand, other than their effective propaganda, but let's leave it at that). But there are many who don't. It's not just about privacy, it's also about things like fear, religious profiling, autocratic tendencies, curbing of freedoms. It's also not about just the current government, but of governments to come. A non-mandatory aadhar would give those who don't trust the system a choice to remain out of its programmes and perhaps voluntarily pay higher costs or forego any benefits. But this government has not given any such choice. It's deeply discomforting to be forced to give all this information to an entity one doesn't trust. [1]: https://thewire.in/146791/uidai-invokes-national-security-reject-rti-query-fake-duplicate-aadhaar-cards/ https://thewire.in/146791/uidai-invokes-national-security-re...

hiyer 9y ago

Amazon only requires id when you order from Amazon Global, and that's because customs requires Indians to provide identity and address proof when you're importing something. If you don't want to provide it to Amazon, you have the option of providing it to the courier service (FedEx/Aramex/whatever). Also, you can provide any other address proof like driving license, electricity bill, voter id etc. Aadhaar is convenient because it is one of the few documents that are accepted as proof of both identity and address (passport, driving license, voter id and ration card are the others). So, yes, clickbait article.

zeusk 9y ago
This particular case is for investigation into a reportedly missing package of a mobile phone; but yes, clickbait.
lightmaker 9y ago
Did you actually read the article? This is more than for just global shopping.
nileshtrivedi 9y ago
Aadhaar is NOT a proof of address. Or Age. UIDAI has clarified it.
- kinkrtyavimoodh 9y ago
  The Aadhaar card has your birth year on it. How is it not a proof of age within a maximum error of one year?
  - pritambaral 9y ago
    In quite many cases, a margin of error of one year is too large for age verification.
  - nileshtrivedi 9y ago
    They don't VERIFY the birth year. It is only as good as the other ID docs submitted to them. In their own words: https://twitter.com/UIDAI/status/934731727808774144 https://twitter.com/UIDAI/status/934731727808774144

deafcalculus 9y ago

The local newspaper reported that the state government is asking for Aadhaar when distributing free HIV medicine. That seems a lot more problematic.

jakeogh 9y ago

A ID number to buy stuff? I remember hearing about that somewhere. I think it was an old book? Someone should tell China, their life gamification score could benefit... ID theft and all.