3 ms·
> made more people vulnerable to many kinds of attacks, including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitig
by amf12 8y ago
> made more people vulnerable to many kinds of attacks, including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitigated disaster would be an understatement.
The problem is not really with Aadhar, but how people and companies use it. Bank accounts are drained because people share their OTP's with the people they don't know, when they should not. Phone number hijacking would have been a problem even without Aadhar since a lot of financial institutions across the world use to for 2FA.
Without Aadhar though, it was even easier to steal someones identity by using a false id. At least with Aadhar based biometric authentication, that't not easy now.
> Bottom line, it’s not the phone number that’s the problem, but having a unique and non-changing number and linking it to everything else (including one’s phone numbers).
A unique and non-changing number and linking it to everything is not the problem, IMO, but with treating that said number as a secret number (akin to the US SSN). With people not being educated about correctly using Aadhar, and entities just using the SMS based 2FA as the authentication mechanism for critical transactions like banking.
- AnthonyMouse 8y ago> The problem is not really with Aadhar, but how people and companies use it. But the way people and companies use it is predictable. They'll tie everything to it in a way that isn't secure (because who are we kidding) in a way that information can't be updated if wrong (because even if the identity is centralized the data isn't). And it will be used comprehensively to coordinate surveillance. But that isn't even the major problem. The problem is that if someone compromises your bank they can steal your money; if they compromise your vehicle ownership info they can steal your car; if they compromise your phone they can invade your privacy; if they compromise your corporate ID they can get inside your company. If they compromise your One True ID, they get all of that all at once and the ability to take out credit in your name, enter contracts in your name, commit crimes in your name, etc. Correspondingly it increases the payoff (and so volume) of attacks and the harm caused by each attack, for a polynomial increase in total damage with the size of the identity system. Creating one system for an entire major country means... you can do the math. On top of that, what if someone were to compromise the system itself, for everyone all at once? Armageddon, basically. Possibly literally if the system is used to control access to weapons of mass destruction. All centralized identity systems are inherently insecure. We don't know how to build something that can withstand the attacks that such a large payout attracts. It's the same category of problem as trying to provide secure law enforcement access to encrypted data. It's too much power to put all in one place. That much centralized power inherently draws in an insurmountable level of corruption and crime, and is a catastrophe as soon as it touches the normal background level of incompetence. And what's so bad about having one ID for your bank, another for your employer?
- mixmastamyk 8y ago> And what's so bad about having one ID for your bank, another for your employer? Is there? Or are they both using SSN?