4 ms·
It's inherent isn't it? A secret number, that you also need to disclose to dozens of organisations repeatedly for various purposes. You might have to give it ov
by lozenge 8y ago
It's inherent isn't it? A secret number, that you also need to disclose to dozens of organisations repeatedly for various purposes. You might have to give it over the phone, but not if they have initiated the call.
- rohit2412 8y agoNo, it's not supposed to be secret. It's not like SSN. Aadhar id is just a unique identifier. Your authentication happens through biometrics.
- Avamander 8y agoEstonia's system uses crypto to authenticate users to sites/services and the UID is considered public data. How does Aadhar handle online authentication?
- rohit2412 8y agoBiometrics/OTP via mobile phones.
- mtgx 8y agoAnd now we know why it's so broken. None of those methods should be used for true security (especially when you're talking about a billion people). Biometrics are not much better than SSNs - once they're stolen, it's game over (for life). The reality is the government chose biometrics primarily so it can more easily track people. It wasn't to make it easier for them to use banking services.
- rohit2412 8y agoBiometrics as a third factor to password and otp would be ideal. However biometrics as a second factor to otp is good enough, to make it frictionless. If that's why it is broken, then I would be happy with it. Nobody is using fake biometrics to authenticate yet. And even then there is the second factor of otp.
- wiml 8y agoSSN isn't supposed to be secret, either. Neither is your mother's maiden name or whatever. But people use them as authenticators anyway.
- davchana 8y agoThe director RS Sharma literally posted his number on personal twitter saying no harm if this number is public. In few minutes people found his school transcripts, bank statements, call logs, amazon orders with cash on delivery were on its way to his house. Few days later official Twitter handle of Aadhar had to say please keep it safe the way you do your wallet or home key. Use it but don't flaunt it.
- rohit2412 8y agoCould you provide source for leaking school transcripts, bank statements, and call logs? He does not address them here https://indianexpress.com/article/opinion/columns/rs-sharma-aadhaar-number-challenge-twitter-trai-chairman-data-protection-5298308/ https://indianexpress.com/article/opinion/columns/rs-sharma-... Cash on delivery just means address was qualified. But address is normally available from other services, and is not achieved by impersonating someone in authenticaiton. Even if all you claimed is true, it just means that the school, the bank, and the telephone company shouldn't take adhaar id as authentication, which it was never intended t be. Use OTP/Biometrics for authentication.
- davchana 8y agoA famous aadhar-opposing French Security specialist posted to his tweet with that aadhar, although Sharma deleted that tweet soon I think. It was on Twitter, I will try to find tomorrow the exact tweet.
- Avamander 8y agoWhy didn't the Adhaar creators not go with PKI like Estonia did?
- rohit2412 8y agoTruthfully estonia's id looks weak too. Stealing an ID is easier than stealing and impersonating biometrics.
- 8y ago