Hacker News Reader

I remember admissions form of children (not sure which Indian state) that contains Aadhar (UID of India) listed in a server with directory listing enabled. Response was - the site is hosted in a secure government datacenter. No chance of leaking data.

I remember accessing SEBI, PWD records through google dorking. They are probably still live, haven't checked. I reported it to all the correct authorities, tried to get in touch with various organizations. To no avail.

I got myself involved in an argument with the Post Office recently. I was posting a letter to an international address and they asked me for - I kid you not - a colour print of my Aadhaar (black and white was rejected).

For people unaware, the document contains your photo, address, date of birth, and a very important number that the government itself 'advises' to not disclose.

I really needed to post that letter so I had to cave in.

When the letter was received, the receiving party told me they also received the Aadhaar stapled with the original letter.

Ironically, this practice of sharing your Aadhaar everywhere seems to stem from trying to "increase security".

It makes sense if you know who the Government thinks is the threat to that security - namely Indians against the government. What they don't seem to realize is that they're leaving the population completely vulnerable from both internal and external actors.

> The next day some lady calls me on my phone. She wouldn't understand the problem. "No Sir, in your personal account, you can only see YOUR documents, Sir." She was basically telling me what the correct behaviour would have been, completely unable to even process the idea that their website might be leaking highly sensitive documents in the wild.

And at that point, you should hand it over to regulatory agencies. It's one thing if some random person emails them, but a government agency letter will get the attention of at least some sort of legal department, if not the corporate leadership.

Can't you just hand that case to your national CERT (Computer Emergency Response Team) and let them handle this? After all, they may have more effective instruments against corporations.

> Corporate answering like you're some kind of clueless idiot is the worst.

I regularly deal with UK banks, many of whose 2nd step auth is to send an SMS to your phone. I regularly ask for other ways of doing the 2nd step such as TOTP or even hardware. I get similar responses back that what they have is secure.

It is not secure. The banking sector's regulations consider it an acceptable 2nd step, which they conflate with being secure. So I regularly get condescending responses about it.

Access to my HSBC accounts is via a digit-only pin and SMS (to the same phone the app is running on) for the second factor. The pin used to be max 9 characters alpha-numeric, which is still bad, and when they changed it (earlier this year) to be shorter and numeric only all the communications were are great pains to assure me that things are just as secure as before… (Which by some definitions may be true: it went from not secure enough to not secure enough).

Luckily for me the only significant thing I have with them is a mortgage that will be paid off in January at which point I'll be closing all accounts I have with them. In the meantime I'll keep pushing about it in every relevant thread in the hope someone high enough up there gets wind and is embarrassed enough to make change happen.

FirstDirect is very similar, though those accounts at least still have 9-character case-sensitive alphanumeric passwords not just a numeric-only pin.

When I had HSBC accounts, their security was laughable but in the other direction: IIRC, in addition to just the plain password which you had to type by hunt-and-peck on an onscreen keyboard, you also had to make up some "security phrase" which they would make you type a few letters from, like the 1st, 3rd, and 24th letters. Maybe their new security approach is a response to that.

In France for some strange reason, banks are forced to have a stupid 6 to 8 number as a password.

Literally [0-9]{6}. They have "secured" it by forcing each bank to implement their own keypad, that randomises the order of keys in order to make scripting much harder.

It makes no sense, my password manager freaks out about it every time. There is TFA (thank goodness), but still, it feels so stupidly unsecured.

I wonder why, and who to complain to, if anyone has any info on that I'll take it

I know at least one french bank which accepts regular strings as passwords, so it may not be a legal requirement. Which makes it confusing why it's so widespread...

Don't worry, they'll "fix" it as most of continental EU banks did: by forcing you to use their app which will break on every OS update (when Android 13 rolled out, one of the banks had their app broken for months and their users couldn't authorize any payments).

You'll also be forced to use the mobile phone of the brand they deem personally "secure". Don't even think about any kind of privacy respecting phones like GrapheneOS. But you'll be secure. At least by definition of their "security consultants".

And if your phone breaks? Well, good luck buying a new one because the payment confirmation app is on that same broken phone.