India's universal ID has security flaws because India has hundreds of languages? That doesn't pass the smell test.
The file they give you as a encrypted pdf of your ID is locked with first four capital letters of your name & then your birth year. It was very touted that this password range is from AAAA to ZZZZ & 0000 to 9999 making a brute force time to 52+ years. But then, nobody before 1918 is alive; & nobody born in 2019 & after. So 0000-9999 becomes 1918-2018. Then names: then most popular name lists are available from many sources. 52 year brute force was proved to be 3 something minutes. The authorities response: they filed criminal cases against who wrote about these flaws.
Why is there a PDF of your identity card, and why is it encrypted? Surely nothing publicly visible on the identity card is private information.
Private identifiers on citizens would not be very useful.
It seems like a lot people here are confused as to what is an identifier and what is authentication. An identifier uniquely identifies someone (the uid), while authentication is the way to prove identity (the password). One is normally public while the other has a secret component to it.
Encrypting with the public key can be done by anyone, but only the private key can decrypt. This allows encrypted communication.
But encrypting with the private key can only be done by someone with the private key. It can be decrypted by anyone, but only using your public key, thus proving your identity; or more accuractely, this proving you have the identified party's private key. So I ask you to encrypt some random OTP to prove your identity. Then I decrypt it with your public key to test your proof. This is how cryptographic signatures work.
Government-issued identification seems an obvious application of PKI.
A public key can be an identity, it's a perfectly workable outcome of Zooko's triangle, but it's not a very useful one for most use cases.
The article is about using phone numbers to uniquely identify people and the problems that brings.
> It seems like a lot people here are confused as to what is an identifier and what is authentication.
I'd say it's you who can't fathom that the two things can work together and only together in some cases.
Not all systems are online/electronic. Although explicitly prohibited, banks keep a paper copy of Aadhar & so do courier delivery, passport etc. Only mobile companies this year have done away with keeping a photostat. Law is, bank or mobile or any ask aadhar number, authenticate the request, fetch required data & store that resulting Boolean.
The problem is how the average person working in the bureaucracy will see this, not how a smart programmer like you on hackernews would see it.
The world is full of average people doing average mistakes in average bureaucracies. Everything that can be abused, will be abused.
Of course, you still need to obtain the PDFs. And there is that wall in the way...
That seems to me like a justification for doing the least amount of work needed. Sure, it's true to some degree, but (taking this case as an example) PKI is objectively uncountably better than a PSK-like structure. There's a base security level and until that's reached, there's no need to expend money and time or inconvenience users to gain greater security. Anyone who doesn't get to that level while designing a project of any importance is a lazy idiot.
Actually, it needs to be both secure and easy to use to work.