5 ms·

Compared to India, Estonia is so small that it is not even funny. India is too big, too complex (16 official languages plus hundreds of dialects). Estonia's pop

by akudha 8y ago

Compared to India, Estonia is so small that it is not even funny. India is too big, too complex (16 official languages plus hundreds of dialects). Estonia's population is ~1.3 million, India's is more than one billion. The sheer scale of it changes the equation dramatically. Add to all this, corruption is a way of life in Indian government(s) - central and local. Even if a system is solid (technology wise), there are tons of social problems to deal with. Comparing Estonia with India is not fair at all, at any level. This is not to take anything away from Estonia's achievement. Kudos to them for setting a great example! But their small size, having to support just one language etc gives them a tremendous advantage

scarejunba 8y ago
India's universal ID has security flaws because India has hundreds of languages? That doesn't pass the smell test.
- themarkn 8y ago
  It's ok for it not to pass the smell test, because what you have stated is not actually the argument being made. The number of languages and dialects was (presumably) brought up to emphasize the many differences in scale and culture (especially government corruption) between India's population and Estonia's that might introduce complexities, incentives, and opportunities for bad actions in one situation that are not applicable in the other.
  - mason55 8y ago
    Either it’s secure or it isn’t. If it isn’t secure then it doesn’t matter if there are only 1.3 million people in the country; I promise someone from outside the country will try to break it.
    - themarkn 8y ago
      Not sure what you mean. Nothing is secure, ever, in a binary sense of being just one thing or the other. It's all a balance between level of security and level of practical usability. Often we've made things easy to use but hard to secure. Like SSNs. But regardless of the source of an attack, the reward for breaking 1 billion targets on the same system vs 1.3 million on a different system is probably much higher. So the inconveniences of more secure systems must be weighed in context of the desirability of the information within them. More attractive targets need more secure, less easy to use, systems.
      - dvdkon 8y ago
        > More attractive targets need more secure, less easy to use, systems. That seems to me like a justification for doing the least amount of work needed. Sure, it's true to some degree, but (taking this case as an example) PKI is objectively uncountably better than a PSK-like structure. There's a base security level and until that's reached, there's no need to expend money and time or inconvenience users to gain greater security. Anyone who doesn't get to that level while designing a project of any importance is a lazy idiot.
        themarkn 8y ago
        Yeah this is a fair point, didn't mean to suggest that easy security wins that dont't inconvenience the user or add cost in some other way aren't worth making.
      - xg15 8y ago
        > More attractive targets need more secure, less easy to use, systems. Actually, it needs to be both secure and easy to use to work.
- davchana 8y ago
  Aadhar has security flaws because people who are responsible for it (directors etc, not coders) are with their heads up in the arse. When a reporter asked an official how they are trying to secure data, the answer was: "The datacenter building surrounding wall is 13feet high & 2 feet thick. Nobody can come & break that wall & steal data." Mind you this datacenter is always online; & is known for pretty basic flaws. The file they give you as a encrypted pdf of your ID is locked with first four capital letters of your name & then your birth year. It was very touted that this password range is from AAAA to ZZZZ & 0000 to 9999 making a brute force time to 52+ years. But then, nobody before 1918 is alive; & nobody born in 2019 & after. So 0000-9999 becomes 1918-2018. Then names: then most popular name lists are available from many sources. 52 year brute force was proved to be 3 something minutes. The authorities response: they filed criminal cases against who wrote about these flaws.
  - spoondan 8y ago
    That’s also just information you know about many of your acquaintances, and that people often publish online. Join a dating site, and you have the password to the PDFs. Of course, you still need to obtain the PDFs. And there is that wall in the way...
    - davchana 8y ago
      Yes, for acquaintance ok, but these files are available for Rs ~1000 on internet, locked. People are not computer savvy, they just go to a printer shop, ask them to print a copy, the guy download a copy, keeps it on his hard disk fot "next" time. Last time I went to get some printouts of my documents, I locked the pdf with complicated password & keyed it in myself, as they insist our printer does not work from USB saved files. Even the delivery boys of various courier companies sellbyour phone number for $1 to local spammers.
  - Avamander 8y ago
    I've asked this elsewhere in this thread and tried to google it but didn't get/haven't gotten an answer, is there a reason Adhaar did not go with PKI to provide identification and signing? Did they have some extreme not-invented-here syndrome?
- dfabulich 8y ago
  Aadhar is easy to phish because it's difficult to educate all Indian people about password security, because India has hundreds of languages.

by akudha 8y ago

scarejunba 8y ago

India's universal ID has security flaws because India has hundreds of languages? That doesn't pass the smell test.

themarkn 8y ago
It's ok for it not to pass the smell test, because what you have stated is not actually the argument being made. The number of languages and dialects was (presumably) brought up to emphasize the many differences in scale and culture (especially government corruption) between India's population and Estonia's that might introduce complexities, incentives, and opportunities for bad actions in one situation that are not applicable in the other.
- mason55 8y ago
  Either it’s secure or it isn’t. If it isn’t secure then it doesn’t matter if there are only 1.3 million people in the country; I promise someone from outside the country will try to break it.
  - themarkn 8y ago
    Not sure what you mean. Nothing is secure, ever, in a binary sense of being just one thing or the other. It's all a balance between level of security and level of practical usability. Often we've made things easy to use but hard to secure. Like SSNs. But regardless of the source of an attack, the reward for breaking 1 billion targets on the same system vs 1.3 million on a different system is probably much higher. So the inconveniences of more secure systems must be weighed in context of the desirability of the information within them. More attractive targets need more secure, less easy to use, systems.
    - dvdkon 8y ago
      > More attractive targets need more secure, less easy to use, systems. That seems to me like a justification for doing the least amount of work needed. Sure, it's true to some degree, but (taking this case as an example) PKI is objectively uncountably better than a PSK-like structure. There's a base security level and until that's reached, there's no need to expend money and time or inconvenience users to gain greater security. Anyone who doesn't get to that level while designing a project of any importance is a lazy idiot.
      - themarkn 8y ago
        Yeah this is a fair point, didn't mean to suggest that easy security wins that dont't inconvenience the user or add cost in some other way aren't worth making.
    - xg15 8y ago
      > More attractive targets need more secure, less easy to use, systems. Actually, it needs to be both secure and easy to use to work.
davchana 8y ago
Aadhar has security flaws because people who are responsible for it (directors etc, not coders) are with their heads up in the arse. When a reporter asked an official how they are trying to secure data, the answer was: "The datacenter building surrounding wall is 13feet high & 2 feet thick. Nobody can come & break that wall & steal data." Mind you this datacenter is always online; & is known for pretty basic flaws. The file they give you as a encrypted pdf of your ID is locked with first four capital letters of your name & then your birth year. It was very touted that this password range is from AAAA to ZZZZ & 0000 to 9999 making a brute force time to 52+ years. But then, nobody before 1918 is alive; & nobody born in 2019 & after. So 0000-9999 becomes 1918-2018. Then names: then most popular name lists are available from many sources. 52 year brute force was proved to be 3 something minutes. The authorities response: they filed criminal cases against who wrote about these flaws.
- spoondan 8y ago
  That’s also just information you know about many of your acquaintances, and that people often publish online. Join a dating site, and you have the password to the PDFs. Of course, you still need to obtain the PDFs. And there is that wall in the way...
  - davchana 8y ago
    Yes, for acquaintance ok, but these files are available for Rs ~1000 on internet, locked. People are not computer savvy, they just go to a printer shop, ask them to print a copy, the guy download a copy, keeps it on his hard disk fot "next" time. Last time I went to get some printouts of my documents, I locked the pdf with complicated password & keyed it in myself, as they insist our printer does not work from USB saved files. Even the delivery boys of various courier companies sellbyour phone number for $1 to local spammers.
- Avamander 8y ago
  I've asked this elsewhere in this thread and tried to google it but didn't get/haven't gotten an answer, is there a reason Adhaar did not go with PKI to provide identification and signing? Did they have some extreme not-invented-here syndrome?
dfabulich 8y ago
Aadhar is easy to phish because it's difficult to educate all Indian people about password security, because India has hundreds of languages.