7 ms·

> including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitigated disaster would be an understatement Can you giv

> including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitigated disaster would be an understatement Can you give sources for that. It's a big claim. > linking one number to everything in one’s life increases the attack surface and the severity of the threats. I think looking bank accounts is absolutely necessary to prevent tax evasion. Intrusive linking with phone numbers etc is undesirable, but it's only for authentication, not surveillance. And having single Id is better than having 10 different disparate ones. Finally, I don't see any evidence that adhaar has been compromised, but that's it's improperly used.

wtmt 8y ago
Please see my other comment below with a few starter links and search terms. There are many people who have lost a lot of money from their bank accounts (including pension money) because Aadhaar provided a new way to defraud people. UIDAI also says Aadhaar is not compromised. The point is that nobody would try hacking the UIDAI database directly when there are far easier and cheaper ways to get to the data through other means because it’s linked with almost everything (depending on the state one lives in). Also please read up on Rachna Khaira’s exposé (in Tribune) on how cheap and easy it was to get access to people’s information from the UIDAI database. That could also be called “hacking”, but the UIDAI won’t admit to that. All this can be blamed on “bad actors” to avoid taking responsibility, but it’s clear that the system and its usage never went through a proper design and test implementation. But all along, there was (and continues to be) a lot of coercion to get people to register for it and link it everywhere. FWIW, this topic makes me very frustrated.
- rohit2412 8y ago
  It doesn't mean that adhaar is intently insecure, or it has been compromised. It merely says that people are not using it for authentication as they should. The attack vectors already existed without a central source of authentication, say with fake birth certificate and no authentication. I still don't see adhaar as a negative, merely being misutilized by different people.
  - shaan7 8y ago
    As it happens in security, something isn't secure by default, you need to verify it is so. I have ZERO way of knowing that UIDAI is following good practices in securing MY[] data. Its not secure till I have proof its secure (well, as secure as we know today). Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.
    - rohit2412 8y ago
      That is very strict requirements. You do not know if your bank, or google account has not been compromised. You do not know if the govt has not secured your passport details safely. Somebody might obtain a fake passport in your name, create a bank account in your name, and conduct fraud? Is it not better to have a central authentication scheme with two factor authentication instead of just a passport? > Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised. Yes, that is a concern. Impersonation in authentication can lead to ruin for people, and the govt wants no liability. But is there any liability currently, in say, a fake passport?
    - concerned_user 8y ago
      Nothing is 100% secure and protected, security is a measure of effort it takes to break it, so what is secure from casual observer, or small organized group can be insecure from a state level actor who has the manpower and equipment to breach it. So there, you have proof that your data is not secure.
  - goombastic 8y ago
    Apart from being technically bogus, access to the entire database is/was available for 500 rupees. The quality of the bureaucrats running it, the opaque way the government pushing it, the lack of actual data to support the IDs, the deaths of people due to denial of life sustaining rations, and the lack of recourse to hold people responsible for life, monetary, and ID theft related losses makes it punishing for people who aren't connected to people in power. Aadhaar cannot be sued for anything! To add insult to the injury, Aadhaar officially allows people in the upper crust and political class to avoid it entirely insulating them from the potential damages of an experimental system. To add even more insult to injury, the UIDAI goes after people who point out the flaws in their "scheme." The only winners seem to be tech providers, contractors, some bureaucrats, and the IT contractors who seem to be making loads of good money on this.
lozenge 8y ago
It's inherent isn't it? A secret number, that you also need to disclose to dozens of organisations repeatedly for various purposes. You might have to give it over the phone, but not if they have initiated the call.
- rohit2412 8y ago
  No, it's not supposed to be secret. It's not like SSN. Aadhar id is just a unique identifier. Your authentication happens through biometrics.
  - Avamander 8y ago
    Estonia's system uses crypto to authenticate users to sites/services and the UID is considered public data. How does Aadhar handle online authentication?
    - rohit2412 8y ago
      Biometrics/OTP via mobile phones.
      - mtgx 8y ago
        And now we know why it's so broken. None of those methods should be used for true security (especially when you're talking about a billion people). Biometrics are not much better than SSNs - once they're stolen, it's game over (for life). The reality is the government chose biometrics primarily so it can more easily track people. It wasn't to make it easier for them to use banking services.
        rohit2412 8y ago
        Biometrics as a third factor to password and otp would be ideal. However biometrics as a second factor to otp is good enough, to make it frictionless. If that's why it is broken, then I would be happy with it. Nobody is using fake biometrics to authenticate yet. And even then there is the second factor of otp.

wtmt 8y ago

Please see my other comment below with a few starter links and search terms. There are many people who have lost a lot of money from their bank accounts (including pension money) because Aadhaar provided a new way to defraud people. UIDAI also says Aadhaar is not compromised. The point is that nobody would try hacking the UIDAI database directly when there are far easier and cheaper ways to get to the data through other means because it’s linked with almost everything (depending on the state one lives in). Also please read up on Rachna Khaira’s exposé (in Tribune) on how cheap and easy it was to get access to people’s information from the UIDAI database. That could also be called “hacking”, but the UIDAI won’t admit to that. All this can be blamed on “bad actors” to avoid taking responsibility, but it’s clear that the system and its usage never went through a proper design and test implementation. But all along, there was (and continues to be) a lot of coercion to get people to register for it and link it everywhere. FWIW, this topic makes me very frustrated.

rohit2412 8y ago
It doesn't mean that adhaar is intently insecure, or it has been compromised. It merely says that people are not using it for authentication as they should. The attack vectors already existed without a central source of authentication, say with fake birth certificate and no authentication. I still don't see adhaar as a negative, merely being misutilized by different people.
- shaan7 8y ago
  As it happens in security, something isn't secure by default, you need to verify it is so. I have ZERO way of knowing that UIDAI is following good practices in securing MY[] data. Its not secure till I have proof its secure (well, as secure as we know today). Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.
  - rohit2412 8y ago
    That is very strict requirements. You do not know if your bank, or google account has not been compromised. You do not know if the govt has not secured your passport details safely. Somebody might obtain a fake passport in your name, create a bank account in your name, and conduct fraud? Is it not better to have a central authentication scheme with two factor authentication instead of just a passport? > Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised. Yes, that is a concern. Impersonation in authentication can lead to ruin for people, and the govt wants no liability. But is there any liability currently, in say, a fake passport?
  - concerned_user 8y ago
    Nothing is 100% secure and protected, security is a measure of effort it takes to break it, so what is secure from casual observer, or small organized group can be insecure from a state level actor who has the manpower and equipment to breach it. So there, you have proof that your data is not secure.
- goombastic 8y ago
  Apart from being technically bogus, access to the entire database is/was available for 500 rupees. The quality of the bureaucrats running it, the opaque way the government pushing it, the lack of actual data to support the IDs, the deaths of people due to denial of life sustaining rations, and the lack of recourse to hold people responsible for life, monetary, and ID theft related losses makes it punishing for people who aren't connected to people in power. Aadhaar cannot be sued for anything! To add insult to the injury, Aadhaar officially allows people in the upper crust and political class to avoid it entirely insulating them from the potential damages of an experimental system. To add even more insult to injury, the UIDAI goes after people who point out the flaws in their "scheme." The only winners seem to be tech providers, contractors, some bureaucrats, and the IT contractors who seem to be making loads of good money on this.

lozenge 8y ago

It's inherent isn't it? A secret number, that you also need to disclose to dozens of organisations repeatedly for various purposes. You might have to give it over the phone, but not if they have initiated the call.

rohit2412 8y ago
No, it's not supposed to be secret. It's not like SSN. Aadhar id is just a unique identifier. Your authentication happens through biometrics.
- Avamander 8y ago
  Estonia's system uses crypto to authenticate users to sites/services and the UID is considered public data. How does Aadhar handle online authentication?
  - rohit2412 8y ago
    Biometrics/OTP via mobile phones.
    - mtgx 8y ago
      And now we know why it's so broken. None of those methods should be used for true security (especially when you're talking about a billion people). Biometrics are not much better than SSNs - once they're stolen, it's game over (for life). The reality is the government chose biometrics primarily so it can more easily track people. It wasn't to make it easier for them to use banking services.
      - rohit2412 8y ago
        Biometrics as a third factor to password and otp would be ideal. However biometrics as a second factor to otp is good enough, to make it frictionless. If that's why it is broken, then I would be happy with it. Nobody is using fake biometrics to authenticate yet. And even then there is the second factor of otp.