4 ms·

Could you provide source for leaking school transcripts, bank statements, and call logs? He does not address them here https://indianexpress.com/article/opinion

Could you provide source for leaking school transcripts, bank statements, and call logs? He does not address them here https://indianexpress.com/article/opinion/columns/rs-sharma-aadhaar-number-challenge-twitter-trai-chairman-data-protection-5298308/ https://indianexpress.com/article/opinion/columns/rs-sharma-... Cash on delivery just means address was qualified. But address is normally available from other services, and is not achieved by impersonating someone in authenticaiton. Even if all you claimed is true, it just means that the school, the bank, and the telephone company shouldn't take adhaar id as authentication, which it was never intended t be. Use OTP/Biometrics for authentication.

davchana 8y ago
A famous aadhar-opposing French Security specialist posted to his tweet with that aadhar, although Sharma deleted that tweet soon I think. It was on Twitter, I will try to find tomorrow the exact tweet.
Avamander 8y ago
Why didn't the Adhaar creators not go with PKI like Estonia did?
- rohit2412 8y ago
  Truthfully estonia's id looks weak too. Stealing an ID is easier than stealing and impersonating biometrics.
  - Lazare 8y ago
    Biometrics are highly problematic in this context. IF someone steals your private key, you can jump through some hoops and get a new one issued, and regain control over your identity. If someone steals your biometric data (and that is a thing that can happen through a variety of methods), there's no form you can fill out be issued new retinas. Your identity is permanently compromised. A moderate increase in security[1] in the average case in exchange for catastrophic failure modes isn't good tradeoff. (And given the very, very troubled history of biometric security, I'm being charitable assuming it's even an increase.)
  - Avamander 8y ago
    Stealing an ID and two PIN codes without the user revoking them all. That's quite hard, isn't it?

davchana 8y ago

A famous aadhar-opposing French Security specialist posted to his tweet with that aadhar, although Sharma deleted that tweet soon I think. It was on Twitter, I will try to find tomorrow the exact tweet.

Avamander 8y ago

Why didn't the Adhaar creators not go with PKI like Estonia did?

rohit2412 8y ago
Truthfully estonia's id looks weak too. Stealing an ID is easier than stealing and impersonating biometrics.
- Lazare 8y ago
  Biometrics are highly problematic in this context. IF someone steals your private key, you can jump through some hoops and get a new one issued, and regain control over your identity. If someone steals your biometric data (and that is a thing that can happen through a variety of methods), there's no form you can fill out be issued new retinas. Your identity is permanently compromised. A moderate increase in security[1] in the average case in exchange for catastrophic failure modes isn't good tradeoff. (And given the very, very troubled history of biometric security, I'm being charitable assuming it's even an increase.)
- Avamander 8y ago
  Stealing an ID and two PIN codes without the user revoking them all. That's quite hard, isn't it?