India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

There's a professor in there too who verified it. Putting the patch out is going to see reporters being jailed and the story being buried. Especially when with the patch we will see 4chan like flaming and the database being filled up with bogus entries from all around the world.

The whole point of the system is to give a single confirmed Identity for citizens of India.

at this point the purpose of the exercise has been voided.

Saying that "the data has not been compromised" is a red herring, thats the case for when our biomterics are lost and our privacy breached which is a whole different issue with this database, one among many of its other problems.

At this point if the data is crud, whats the point of using this system?

Professor means nothing. I know a lot of professors who have plagiarised to obtain PhDs. So I would never accept a professor's word to technical details.

> Putting the patch out is going to see reporters being jailed and the story being buried

That's a ridiculous assertion. Wasn't a reporter from Tribune already booked for spreading the same nonsense a while back? Why so? Because she was unable to provide any evidence for the said software that could gain access to UIDAI database.

If you are going to be worried about being arrested then don't get into journalism. Journalism is all about taking risks. By putting out the patch in public domain the reporters are actually going to get immunity from arrests as everyone will know the facts and any arrest by the government would be seen in a negative light. Right now, the reporters have a higher probability of being arrested for indulging in spreading false information, to their own detriment.

> Especially when with the patch we will see 4chan like flaming and the database being filled up with bogus entries from all around the world.

What better proof of breach than having the entire database filled with bogus entries? That should make it amply clear to everyone involved including the public that the system is not secure. What is surprising is that reporters use the garb of national security when it pleases them. You can't have it both ways. If you truly believe in national security and that the entire database is compromised and that there is no way to fix the problem without fundamental change to the system then release the patch. Withholding the patch is detrimental to national security as you are deliberately allowing nefarious activities to take place unchecked and unhindered.

This is a true story -

I went to a regional passport office to get my Aadhar card about 2 years ago. I sat in front of a desk with an employee - she was logged in to a website to that let her upload my picture/biometrics and info into the Aadhar system. The desk had a post-it 3 feet away from me with the login username/password written on it.

Since the operators also need to verify biometrically to login, that alone wouldn't be enough to hack it. But if you think about the general level of understanding of IT among the public, and probably even the people who wrote the software, its pretty unsurprising to see it hacked.

Even so, I don't think its really possible for a huge entity like the government (or even a large company) to learn all the practices around security/technology without making mistakes and learning under situations with real consequences. As long as they learn from these mistakes and accept failure, rather than trying to cover them up, we will get there in time.

> Pretty simple. Do you want everyone in the world to have access to the database? Now at least it is hidden through obscurity. This is exactly why in this report the said journalist got it verified by three external experts, one of them a professor.

Don't you think this is pretty convenient an excuse? The report is also not in public domain nor is the exploit. We have to just rely on a journalist, a CTO, a professor and another person as "proof". Meltdown and Spectre are way more serious exploits as it affects pretty much the entire World and it was disclosed but this exploit is supposedly so much more heinous that it cannot be disclosed.

> Do you have a conflict on interest with this project? I see on your Twitter that you have retweeted some posts from Ministry overlooking this project. Not casting doubt, just needing a clarification due to the tone of your posts in this thread. Sounds very government'ish.

It always sounds government'ish to people who rely on conspiracy theories. I am an open supporter of the Government in many policies. As far as conflict of interest with this project I am no way connected to the UIDAI project. So don't try to find connections where there are none.

> I see on your Twitter that you have retweeted some posts from Ministry overlooking this project.

I haven't retweeted anything to do with Aadhaar. The retweets are GST related and another one to do with AI. It's ridiculous to assert that just because I support the government and I retweet some of the policy decisions I end up becoming a supporter of Aadhaar. Don't forget that Aadhaar was formulated and ratified by the previous government. Also, I dislike Nandan Nilekani for how he handled implementation of GST and Aadhaar itself. If at all there is something Aadhaar seriously lacks: it is proper communication with the people about how data is stored and stupid decisions by the UIDAI to link Aadhaar for anything and everything (including the recent one with requiring Aadhaar for sending posts overseas). I don't support such ridiculous decisions.

> Forget the grammar, typos it doesn't matter. Ignore the whole of his letter except the official correspondence that is attached and does in fact validate his/her point.

I am rational in my thinking and approach. When I see fake news I call it out. You relied on it not me.

> Authority has no way to audit the fake accounts, authority does know for which entries backup documentation exists or not. In fact, he attaches official documentation later on as an evidence.

Which official document? There is nothing in the letter that is "official document". Even the table that he mentions is not available in public domain to authenticate. I can create a table myself and call it "official document". Would that be sufficient evidence in the court of law?

Also, if such a letter was indeed written, why haven't any Supreme Court judge confirmed receipt of such a letter?

> I meant to write Aadhar data. So you are totally over loooking the fact that some of the Aadhar related data was on US servers, and more importantly the password is being relayed over E-mail? Also, no secure way to host the government data, except HP servers?

You are assuming a lot here. There is no indication that the data on the US servers was Aadhaar related.

> Government has been so opaque regarding this project that we have to rely on journalists, researchers and whistleblowers to help us with any sliver of info.

No it's the other way around. The journalists, researchers and whistleblowers are the ones who are being opaque with their findings. At the end of the day, if you find a loophole, it's your responsibility to make it known to the public if the Government refuses to acknowledge it. Media is the fourth arm of democracy for a reason. If you know that the Government is deliberately trying to hide details of exploits from the public, it automatically becomes your responsibility to disclose the exploit itself. By withholding the details of the exploit, you are strengthening the hands of nefarious non-state actors because they know that the Government would turn away and reporters would never expose. You release the exploit in the public domain, it automatically creates pressure on the Government and force it to either fix the issue or accept responsibility.