Hacker News Reader

Comment by rohit2412 | Hacker News Reader

It doesn't mean that adhaar is intently insecure, or it has been compromised. It merely says that people are not using it for authentication as they should.

The attack vectors already existed without a central source of authentication, say with fake birth certificate and no authentication.

I still don't see adhaar as a negative, merely being misutilized by different people.

View on HN

Apart from being technically bogus, access to the entire database is/was available for 500 rupees. The quality of the bureaucrats running it, the opaque way the government pushing it, the lack of actual data to support the IDs, the deaths of people due to denial of life sustaining rations, and the lack of recourse to hold people responsible for life, monetary, and ID theft related losses makes it punishing for people who aren't connected to people in power. Aadhaar cannot be sued for anything!

To add insult to the injury, Aadhaar officially allows people in the upper crust and political class to avoid it entirely insulating them from the potential damages of an experimental system. To add even more insult to injury, the UIDAI goes after people who point out the flaws in their "scheme."

The only winners seem to be tech providers, contractors, some bureaucrats, and the IT contractors who seem to be making loads of good money on this.

> access to the entire database is/was available for 500 rupees

Not the biometrics. And the leaked information doesn't allow one to impersonate someone.

Is the alternative of relying on passports/birth certificate better? Are you against any universal id scheme in general?

All the criticism of adhaar seems shallow. If your home address is leaked somehow, say by a customer service representative in a bank, would you say that is the failure of the post office? It is a privacy risk to have one's address out in the public, but is that a reason to oppose post offices, or stop living in houses?

>Not the biometrics.

What use is biometrics when I can update the actual record itself?

>And the leaked information doesn't allow one to impersonate someone.

Thats because the biometrics doesnt work for anyone 60-70% of the time.

As it happens in security, something isn't secure by default, you need to verify it is so. I have ZERO way of knowing that UIDAI is following good practices in securing MY[] data. Its not secure till I have proof its secure (well, as secure as we know today).

Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.

That is very strict requirements. You do not know if your bank, or google account has not been compromised. You do not know if the govt has not secured your passport details safely. Somebody might obtain a fake passport in your name, create a bank account in your name, and conduct fraud? Is it not better to have a central authentication scheme with two factor authentication instead of just a passport?

> Well thats the other problem with Aadhar. According to the Aadhar Act (2017?), all Aadhar related data (including my biometrics) are property of UIDAI. So I don't even own any rights and hence (as explicitly stated in the act) have no legal recourse if that data is compromised.

Yes, that is a concern. Impersonation in authentication can lead to ruin for people, and the govt wants no liability. But is there any liability currently, in say, a fake passport?

Nothing is 100% secure and protected, security is a measure of effort it takes to break it, so what is secure from casual observer, or small organized group can be insecure from a state level actor who has the manpower and equipment to breach it.

So there, you have proof that your data is not secure.

Reply on news.ycombinator.com