Hacker News Reader

Comment by rohit2412 | Hacker News Reader

> including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitigated disaster would be an understatement

Can you give sources for that. It's a big claim.

> linking one number to everything in one’s life increases the attack surface and the severity of the threats.

I think looking bank accounts is absolutely necessary to prevent tax evasion. Intrusive linking with phone numbers etc is undesirable, but it's only for authentication, not surveillance. And having single Id is better than having 10 different disparate ones. Finally, I don't see any evidence that adhaar has been compromised, but that's it's improperly used.

View on HN

It's inherent isn't it? A secret number, that you also need to disclose to dozens of organisations repeatedly for various purposes. You might have to give it over the phone, but not if they have initiated the call.

No, it's not supposed to be secret. It's not like SSN. Aadhar id is just a unique identifier. Your authentication happens through biometrics.

Estonia's system uses crypto to authenticate users to sites/services and the UID is considered public data. How does Aadhar handle online authentication?

Biometrics/OTP via mobile phones.

And now we know why it's so broken. None of those methods should be used for true security (especially when you're talking about a billion people). Biometrics are not much better than SSNs - once they're stolen, it's game over (for life).

The reality is the government chose biometrics primarily so it can more easily track people. It wasn't to make it easier for them to use banking services.

Biometrics as a third factor to password and otp would be ideal. However biometrics as a second factor to otp is good enough, to make it frictionless.

If that's why it is broken, then I would be happy with it. Nobody is using fake biometrics to authenticate yet. And even then there is the second factor of otp.

SSN isn't supposed to be secret, either. Neither is your mother's maiden name or whatever. But people use them as authenticators anyway.

The director RS Sharma literally posted his number on personal twitter saying no harm if this number is public. In few minutes people found his school transcripts, bank statements, call logs, amazon orders with cash on delivery were on its way to his house. Few days later official Twitter handle of Aadhar had to say please keep it safe the way you do your wallet or home key. Use it but don't flaunt it.

Could you provide source for leaking school transcripts, bank statements, and call logs? He does not address them here https://indianexpress.com/article/opinion/columns/rs-sharma-...

Cash on delivery just means address was qualified. But address is normally available from other services, and is not achieved by impersonating someone in authenticaiton.

Even if all you claimed is true, it just means that the school, the bank, and the telephone company shouldn't take adhaar id as authentication, which it was never intended t be. Use OTP/Biometrics for authentication.

A famous aadhar-opposing French Security specialist posted to his tweet with that aadhar, although Sharma deleted that tweet soon I think. It was on Twitter, I will try to find tomorrow the exact tweet.

Why didn't the Adhaar creators not go with PKI like Estonia did?

Truthfully estonia's id looks weak too. Stealing an ID is easier than stealing and impersonating biometrics.

Biometrics are highly problematic in this context. IF someone steals your private key, you can jump through some hoops and get a new one issued, and regain control over your identity.

If someone steals your biometric data (and that is a thing that can happen through a variety of methods), there's no form you can fill out be issued new retinas. Your identity is permanently compromised.

A moderate increase in security[1] in the average case in exchange for catastrophic failure modes isn't good tradeoff.

(And given the very, very troubled history of biometric security, I'm being charitable assuming it's even an increase.)

Stealing an ID and two PIN codes without the user revoking them all. That's quite hard, isn't it?

This is just wrong. They found that out using Google search and social engineering. A lot of his details like his phone number were available online and were available with a Google search. Amazon, being stupid, uses a copy of Aadhar as an authentication mechanism. The Aadhar number is not supposed to be secret. That's the reason you need to use biometrics along with your number to authenticate you.

UIDAI keeps switching the stance almost every week: it is secret; it is not; it is kind of; repeat.

Please see my other comment below with a few starter links and search terms. There are many people who have lost a lot of money from their bank accounts (including pension money) because Aadhaar provided a new way to defraud people.

UIDAI also says Aadhaar is not compromised. The point is that nobody would try hacking the UIDAI database directly when there are far easier and cheaper ways to get to the data through other means because it’s linked with almost everything (depending on the state one lives in).

Also please read up on Rachna Khaira’s exposé (in Tribune) on how cheap and easy it was to get access to people’s information from the UIDAI database. That could also be called “hacking”, but the UIDAI won’t admit to that.

All this can be blamed on “bad actors” to avoid taking responsibility, but it’s clear that the system and its usage never went through a proper design and test implementation. But all along, there was (and continues to be) a lot of coercion to get people to register for it and link it everywhere.

FWIW, this topic makes me very frustrated.

It doesn't mean that adhaar is intently insecure, or it has been compromised. It merely says that people are not using it for authentication as they should.

The attack vectors already existed without a central source of authentication, say with fake birth certificate and no authentication.

I still don't see adhaar as a negative, merely being misutilized by different people.

As it happens in security, something isn't secure by default, you need to verify it is so. I have ZERO way of knowing that UIDAI is following good practices in securing MY[] data. Its not secure till I have proof its secure (well, as secure as we know today).

Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.

That is very strict requirements. You do not know if your bank, or google account has not been compromised. You do not know if the govt has not secured your passport details safely. Somebody might obtain a fake passport in your name, create a bank account in your name, and conduct fraud? Is it not better to have a central authentication scheme with two factor authentication instead of just a passport?

> Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.

Yes, that is a concern. Impersonation in authentication can lead to ruin for people, and the govt wants no liability. But is there any liability currently, in say, a fake passport?

Nothing is 100% secure and protected, security is a measure of effort it takes to break it, so what is secure from casual observer, or small organized group can be insecure from a state level actor who has the manpower and equipment to breach it.

So there, you have proof that your data is not secure.

Apart from being technically bogus, access to the entire database is/was available for 500 rupees. The quality of the bureaucrats running it, the opaque way the government pushing it, the lack of actual data to support the IDs, the deaths of people due to denial of life sustaining rations, and the lack of recourse to hold people responsible for life, monetary, and ID theft related losses makes it punishing for people who aren't connected to people in power. Aadhaar cannot be sued for anything!

To add insult to the injury, Aadhaar officially allows people in the upper crust and political class to avoid it entirely insulating them from the potential damages of an experimental system. To add even more insult to injury, the UIDAI goes after people who point out the flaws in their "scheme."

The only winners seem to be tech providers, contractors, some bureaucrats, and the IT contractors who seem to be making loads of good money on this.

> access to the entire database is/was available for 500 rupees

Not the biometrics. And the leaked information doesn't allow one to impersonate someone.

Is the alternative of relying on passports/birth certificate better? Are you against any universal id scheme in general?

All the criticism of adhaar seems shallow. If your home address is leaked somehow, say by a customer service representative in a bank, would you say that is the failure of the post office? It is a privacy risk to have one's address out in the public, but is that a reason to oppose post offices, or stop living in houses?

>Not the biometrics.

What use is biometrics when I can update the actual record itself?

>And the leaked information doesn't allow one to impersonate someone.

Thats because the biometrics doesnt work for anyone 60-70% of the time.

Reply on news.ycombinator.com