Comment by wtmt | Hacker News Reader

Comment by wtmt | Hacker News Reader

Parent Full thread

Please see my other comment below with a few starter links and search terms. There are many people who have lost a lot of money from their bank accounts (including pension money) because Aadhaar provided a new way to defraud people.

UIDAI also says Aadhaar is not compromised. The point is that nobody would try hacking the UIDAI database directly when there are far easier and cheaper ways to get to the data through other means because it’s linked with almost everything (depending on the state one lives in).

Also please read up on Rachna Khaira’s exposé (in Tribune) on how cheap and easy it was to get access to people’s information from the UIDAI database. That could also be called “hacking”, but the UIDAI won’t admit to that.

All this can be blamed on “bad actors” to avoid taking responsibility, but it’s clear that the system and its usage never went through a proper design and test implementation. But all along, there was (and continues to be) a lot of coercion to get people to register for it and link it everywhere.

FWIW, this topic makes me very frustrated.

It doesn't mean that adhaar is intently insecure, or it has been compromised. It merely says that people are not using it for authentication as they should.

The attack vectors already existed without a central source of authentication, say with fake birth certificate and no authentication.

I still don't see adhaar as a negative, merely being misutilized by different people.

As it happens in security, something isn't secure by default, you need to verify it is so. I have ZERO way of knowing that UIDAI is following good practices in securing MY[] data. Its not secure till I have proof its secure (well, as secure as we know today).

Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.

That is very strict requirements. You do not know if your bank, or google account has not been compromised. You do not know if the govt has not secured your passport details safely. Somebody might obtain a fake passport in your name, create a bank account in your name, and conduct fraud? Is it not better to have a central authentication scheme with two factor authentication instead of just a passport?

> Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.

Yes, that is a concern. Impersonation in authentication can lead to ruin for people, and the govt wants no liability. But is there any liability currently, in say, a fake passport?

Nothing is 100% secure and protected, security is a measure of effort it takes to break it, so what is secure from casual observer, or small organized group can be insecure from a state level actor who has the manpower and equipment to breach it.

So there, you have proof that your data is not secure.

Apart from being technically bogus, access to the entire database is/was available for 500 rupees. The quality of the bureaucrats running it, the opaque way the government pushing it, the lack of actual data to support the IDs, the deaths of people due to denial of life sustaining rations, and the lack of recourse to hold people responsible for life, monetary, and ID theft related losses makes it punishing for people who aren't connected to people in power. Aadhaar cannot be sued for anything!

To add insult to the injury, Aadhaar officially allows people in the upper crust and political class to avoid it entirely insulating them from the potential damages of an experimental system. To add even more insult to injury, the UIDAI goes after people who point out the flaws in their "scheme."

The only winners seem to be tech providers, contractors, some bureaucrats, and the IT contractors who seem to be making loads of good money on this.

> access to the entire database is/was available for 500 rupees

Not the biometrics. And the leaked information doesn't allow one to impersonate someone.

Is the alternative of relying on passports/birth certificate better? Are you against any universal id scheme in general?

All the criticism of adhaar seems shallow. If your home address is leaked somehow, say by a customer service representative in a bank, would you say that is the failure of the post office? It is a privacy risk to have one's address out in the public, but is that a reason to oppose post offices, or stop living in houses?

>Not the biometrics.

What use is biometrics when I can update the actual record itself?

>And the leaked information doesn't allow one to impersonate someone.

Thats because the biometrics doesnt work for anyone 60-70% of the time.

Reply on news.ycombinator.com