7 ms·

Aadhar has security flaws because people who are responsible for it (directors etc, not coders) are with their heads up in the arse. When a reporter asked an of

Aadhar has security flaws because people who are responsible for it (directors etc, not coders) are with their heads up in the arse. When a reporter asked an official how they are trying to secure data, the answer was: "The datacenter building surrounding wall is 13feet high & 2 feet thick. Nobody can come & break that wall & steal data." Mind you this datacenter is always online; & is known for pretty basic flaws. The file they give you as a encrypted pdf of your ID is locked with first four capital letters of your name & then your birth year. It was very touted that this password range is from AAAA to ZZZZ & 0000 to 9999 making a brute force time to 52+ years. But then, nobody before 1918 is alive; & nobody born in 2019 & after. So 0000-9999 becomes 1918-2018. Then names: then most popular name lists are available from many sources. 52 year brute force was proved to be 3 something minutes. The authorities response: they filed criminal cases against who wrote about these flaws.

spoondan 8y ago
That’s also just information you know about many of your acquaintances, and that people often publish online. Join a dating site, and you have the password to the PDFs. Of course, you still need to obtain the PDFs. And there is that wall in the way...
- davchana 8y ago
  Yes, for acquaintance ok, but these files are available for Rs ~1000 on internet, locked. People are not computer savvy, they just go to a printer shop, ask them to print a copy, the guy download a copy, keeps it on his hard disk fot "next" time. Last time I went to get some printouts of my documents, I locked the pdf with complicated password & keyed it in myself, as they insist our printer does not work from USB saved files. Even the delivery boys of various courier companies sellbyour phone number for $1 to local spammers.
Avamander 8y ago
I've asked this elsewhere in this thread and tried to google it but didn't get/haven't gotten an answer, is there a reason Adhaar did not go with PKI to provide identification and signing? Did they have some extreme not-invented-here syndrome?
- xorcist 8y ago
  It is hard to understand the argument here. PKI is not identity. Why is there a PDF of your identity card, and why is it encrypted? Surely nothing publicly visible on the identity card is private information. Private identifiers on citizens would not be very useful. It seems like a lot people here are confused as to what is an identifier and what is authentication. An identifier uniquely identifies someone (the uid), while authentication is the way to prove identity (the password). One is normally public while the other has a secret component to it.
  - davchana 8y ago
    Pdf is so that Authorities do not need to print & deliver card at home( they take 20-90 days for that). They say people can download & print it as & when required. Not all systems are online/electronic. Although explicitly prohibited, banks keep a paper copy of Aadhar & so do courier delivery, passport etc. Only mobile companies this year have done away with keeping a photostat. Law is, bank or mobile or any ask aadhar number, authenticate the request, fetch required data & store that resulting Boolean.
  - Avamander 8y ago
    Estonia's PKI is basically identity. Yes, you could build something on top of the public Personal Identification Number, but no reasonable provider accepts that as the username - it is a person using the certificate stored on smartcard/smart SIM(/phone) to identify and authenticate at the same time. > It seems like a lot people here are confused as to what is an identifier and what is authentication. I'd say it's you who can't fathom that the two things can work together and only together in some cases.
  - nulbyte 8y ago
    Perhaps unwittingly, you just described PKI. Two keys: one is public and identifies someone (or something), and the other is private and can be used to prove your identity. Encrypting with the public key can be done by anyone, but only the private key can decrypt. This allows encrypted communication. But encrypting with the private key can only be done by someone with the private key. It can be decrypted by anyone, but only using your public key, thus proving your identity; or more accuractely, this proving you have the identified party's private key. So I ask you to encrypt some random OTP to prove your identity. Then I decrypt it with your public key to test your proof. This is how cryptographic signatures work. Government-issued identification seems an obvious application of PKI.
concerned_user 8y ago
That is irrelevant you can get information contained in the PDF just by taking a photo of the card, so nothing that wasn't meant to be public is in that PDF.
- davchana 8y ago
  But UIDAI itself tweets so many videos saying share your Aadhar number with banks n such, but not on social media aka internet; i.e. treat it like your wallet, use it with caution & dont flaunt it. & leaked/stolen pdfs most likely end up on internet.

spoondan 8y ago

That’s also just information you know about many of your acquaintances, and that people often publish online. Join a dating site, and you have the password to the PDFs. Of course, you still need to obtain the PDFs. And there is that wall in the way...

davchana 8y ago
Yes, for acquaintance ok, but these files are available for Rs ~1000 on internet, locked. People are not computer savvy, they just go to a printer shop, ask them to print a copy, the guy download a copy, keeps it on his hard disk fot "next" time. Last time I went to get some printouts of my documents, I locked the pdf with complicated password & keyed it in myself, as they insist our printer does not work from USB saved files. Even the delivery boys of various courier companies sellbyour phone number for $1 to local spammers.

Avamander 8y ago

I've asked this elsewhere in this thread and tried to google it but didn't get/haven't gotten an answer, is there a reason Adhaar did not go with PKI to provide identification and signing? Did they have some extreme not-invented-here syndrome?

xorcist 8y ago
It is hard to understand the argument here. PKI is not identity. Why is there a PDF of your identity card, and why is it encrypted? Surely nothing publicly visible on the identity card is private information. Private identifiers on citizens would not be very useful. It seems like a lot people here are confused as to what is an identifier and what is authentication. An identifier uniquely identifies someone (the uid), while authentication is the way to prove identity (the password). One is normally public while the other has a secret component to it.
- davchana 8y ago
  Pdf is so that Authorities do not need to print & deliver card at home( they take 20-90 days for that). They say people can download & print it as & when required. Not all systems are online/electronic. Although explicitly prohibited, banks keep a paper copy of Aadhar & so do courier delivery, passport etc. Only mobile companies this year have done away with keeping a photostat. Law is, bank or mobile or any ask aadhar number, authenticate the request, fetch required data & store that resulting Boolean.
- Avamander 8y ago
  Estonia's PKI is basically identity. Yes, you could build something on top of the public Personal Identification Number, but no reasonable provider accepts that as the username - it is a person using the certificate stored on smartcard/smart SIM(/phone) to identify and authenticate at the same time. > It seems like a lot people here are confused as to what is an identifier and what is authentication. I'd say it's you who can't fathom that the two things can work together and only together in some cases.
- nulbyte 8y ago
  Perhaps unwittingly, you just described PKI. Two keys: one is public and identifies someone (or something), and the other is private and can be used to prove your identity. Encrypting with the public key can be done by anyone, but only the private key can decrypt. This allows encrypted communication. But encrypting with the private key can only be done by someone with the private key. It can be decrypted by anyone, but only using your public key, thus proving your identity; or more accuractely, this proving you have the identified party's private key. So I ask you to encrypt some random OTP to prove your identity. Then I decrypt it with your public key to test your proof. This is how cryptographic signatures work. Government-issued identification seems an obvious application of PKI.

concerned_user 8y ago

That is irrelevant you can get information contained in the PDF just by taking a photo of the card, so nothing that wasn't meant to be public is in that PDF.

davchana 8y ago
But UIDAI itself tweets so many videos saying share your Aadhar number with banks n such, but not on social media aka internet; i.e. treat it like your wallet, use it with caution & dont flaunt it. & leaked/stolen pdfs most likely end up on internet.