5 ms·

Is this complete incompetence? Why wouldn't they generate these numbers on some centralized secured servers only for the verified individuals? Why give away the

Is this complete incompetence? Why wouldn't they generate these numbers on some centralized secured servers only for the verified individuals? Why give away the software that generates them at all? That's like giving away your signing servers.

arachnids 8y ago
That is answered in the article > B. Regunath, a software architect who led the team at Mindtree that worked on the project, said a web-based enrolment software for Aadhaar was not practical at the time because many parts of the country had very poor Internet connectivity. Of course, anyone who put id generating software on these laptops with the expectation that it would somehow remain secret was being extremely foolish. The system should have been designed taking that into account.
- bufferoverflow 8y ago
  Even then, they could have batched the requests for IDs on the laptop, and then submitted them daily/weekly by driving the laptop to wherever the internet is. And of course, each such laptop must have a unique hardware key that would sign these requests, so copying the software wouldn't compromise anything.
  - cm2187 8y ago
    In a country of the scale of India, if your security relies on no laptop being compromised, you have no security. One is bound to be lost or stolen (or its user to accept bribes).
    - bufferoverflow 8y ago
      You didn't read my comment well. The security in my scenario doesn't rely on the laptop not being stolen. There's a hardware key. If it gets stolen, it gets blacklisted.
      - dpacmittal 8y ago
        It will not work in India. The whole problem is that the govt pissed off the operators and incentivized them to create fake aadhar. He whole investment to setup aadhar enrollment centre was marketed as a good business which will make people decent sum of money. But that was a very optimistic approximate. Reality turned out to be far more different. Almost all operators went into a loss. To recuperate the losses, they started creating fake aadhar. Money earned for genuine aadhar is Rs. 20, vs Rs. 500+ for a fake aadhar. It was stupid for operators to not exploit the opportunity. In this scenario a hardware key is not going to help. It'll only limit the ubiquity of the hack, but not much else.
candiodari 8y ago
You are assuming this is unintentional. Giving bureaucrats and criminals working with them power through incompetence of the central government ... forgive me for doubting that this was a design feature. It redivides the power between individuals and the state, including criminals working with (small parts of) the state. I believe anyone who can get a majority of 1.3 billion people to vote for him did not miss this. I mean what's with the "Caesar can do no wrong" attitude on this site ? States are evil. The best possible case is that they might be, at times, the lesser evil.
- lmcm82 8y ago
  >States are evil. The best possible case is that they might be, at times, the lesser evil. Calm down there American.
  - candiodari 8y ago
    I am European. Just because it's a less popular opinion, it's not any less true. I don't even understand the logic itself. States are supposedly not evil, and we need them because ... well because people are more evil. That's the idea. But states are people. Isn't that by itself a massive contradiction ? The difference between, say, the Netherlands and Monsanto is the method of incorporation, and the legal authority it therefore has. Not the resulting decisions. That's, of course why the Netherlands got rich by having it's military protect and pay raping pirates, in trade for their loot, including of course, if they had to sell the passengers to prostitution houses and mines, and still does things like extracting money from it's poorest citizens through mental health "care". Monsanto merely mass-poisons people. But the big difference is: 1) the dutch state has never apologized 2) has never paid any restitution to anyone 3) never will
    - krageon 8y ago
      You picked one of the countries with the most evil government (historically, I make no claim either way about the current situation) as an example. Of course it's going to look bad in that case.
jace 8y ago
The numbers are not generated on the client side. An enrollment packet is, containing biometrics and demographics, for which a number will be generated using biometric deduplication server-side. The catch: only residents (not citizens) of India are authorised to have a number. Because one person technically cannot have more than one Aadhaar number (reality: ha!), the theory is that a government subsidy database needs one unique Aadhaar number per beneficiary. This theory breaks down when you enroll an individual who does not need an Aadhaar number because they are not a resident. That number can be misused by another resident to get a second entry into the database, and it's a perfectly legitimate number linked to an Indian phone number that can receive an OTP and behave indistinguishably from a resident. Fake enrolments are the equivalent of a hack of the US SSN system that would allow anyone anywhere in the world to make an SSN for themselves. What could they possibly do with that?

arachnids 8y ago

That is answered in the article > B. Regunath, a software architect who led the team at Mindtree that worked on the project, said a web-based enrolment software for Aadhaar was not practical at the time because many parts of the country had very poor Internet connectivity. Of course, anyone who put id generating software on these laptops with the expectation that it would somehow remain secret was being extremely foolish. The system should have been designed taking that into account.

bufferoverflow 8y ago
Even then, they could have batched the requests for IDs on the laptop, and then submitted them daily/weekly by driving the laptop to wherever the internet is. And of course, each such laptop must have a unique hardware key that would sign these requests, so copying the software wouldn't compromise anything.
- cm2187 8y ago
  In a country of the scale of India, if your security relies on no laptop being compromised, you have no security. One is bound to be lost or stolen (or its user to accept bribes).
  - bufferoverflow 8y ago
    You didn't read my comment well. The security in my scenario doesn't rely on the laptop not being stolen. There's a hardware key. If it gets stolen, it gets blacklisted.
    - dpacmittal 8y ago
      It will not work in India. The whole problem is that the govt pissed off the operators and incentivized them to create fake aadhar. He whole investment to setup aadhar enrollment centre was marketed as a good business which will make people decent sum of money. But that was a very optimistic approximate. Reality turned out to be far more different. Almost all operators went into a loss. To recuperate the losses, they started creating fake aadhar. Money earned for genuine aadhar is Rs. 20, vs Rs. 500+ for a fake aadhar. It was stupid for operators to not exploit the opportunity. In this scenario a hardware key is not going to help. It'll only limit the ubiquity of the hack, but not much else.

candiodari 8y ago

You are assuming this is unintentional. Giving bureaucrats and criminals working with them power through incompetence of the central government ... forgive me for doubting that this was a design feature. It redivides the power between individuals and the state, including criminals working with (small parts of) the state. I believe anyone who can get a majority of 1.3 billion people to vote for him did not miss this. I mean what's with the "Caesar can do no wrong" attitude on this site ? States are evil. The best possible case is that they might be, at times, the lesser evil.

lmcm82 8y ago
>States are evil. The best possible case is that they might be, at times, the lesser evil. Calm down there American.
- candiodari 8y ago
  I am European. Just because it's a less popular opinion, it's not any less true. I don't even understand the logic itself. States are supposedly not evil, and we need them because ... well because people are more evil. That's the idea. But states are people. Isn't that by itself a massive contradiction ? The difference between, say, the Netherlands and Monsanto is the method of incorporation, and the legal authority it therefore has. Not the resulting decisions. That's, of course why the Netherlands got rich by having it's military protect and pay raping pirates, in trade for their loot, including of course, if they had to sell the passengers to prostitution houses and mines, and still does things like extracting money from it's poorest citizens through mental health "care". Monsanto merely mass-poisons people. But the big difference is: 1) the dutch state has never apologized 2) has never paid any restitution to anyone 3) never will
  - krageon 8y ago
    You picked one of the countries with the most evil government (historically, I make no claim either way about the current situation) as an example. Of course it's going to look bad in that case.

jace 8y ago

The numbers are not generated on the client side. An enrollment packet is, containing biometrics and demographics, for which a number will be generated using biometric deduplication server-side. The catch: only residents (not citizens) of India are authorised to have a number. Because one person technically cannot have more than one Aadhaar number (reality: ha!), the theory is that a government subsidy database needs one unique Aadhaar number per beneficiary. This theory breaks down when you enroll an individual who does not need an Aadhaar number because they are not a resident. That number can be misused by another resident to get a second entry into the database, and it's a perfectly legitimate number linked to an Indian phone number that can receive an OTP and behave indistinguishably from a resident. Fake enrolments are the equivalent of a hack of the US SSN system that would allow anyone anywhere in the world to make an SSN for themselves. What could they possibly do with that?