Live data from Hacker News

India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

huffingtonpost.in

141–150 of 163 posts

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#141

Earlier quoted context omitted.

> And the database has not been compromised. The database is not known to be compromised.

> The database is not known to be compromised. The database is not known by the general public to be compromised.

The database is known by the general public to be compromised.

https://thewire.in/government/data-breach-aadhaar-details-gr...

The reason this article didn't mention it is because one of the authors is still in hot water with the police for trying to report on it.

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#142
post #90
post #27

Time and Time again Aadhar's privacy data have been compromised and Yet, Officials have strongly denied all those claims - only possible because still people believe all the false claims by those officials and government in terms of Aadhar. Even to the level that a guy once wrote a scraper (opensourced on github) that can fetch Aadhar info online. It's no doubt that Aadhar was a blatant copy of bringing an SSN-type I…

> Time and Time again Aadhar's privacy data have been compromised. I hate the implementation of Aadhar as much as any person, and believe the architecture is terrible that a patch can allow authentication to be bypassed. And that there could be more vulnerabilities. However, at least in this instance, existing data has not been compromised.

Unfortunately, there also exists other software that easily allows compromising existing data.

https://thewire.in/government/data-breach-aadhaar-details-gr...

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#143
post #129

Earlier quoted context omitted.

>Can the said journalist just release the application in public domain? If not, why not? Pretty simple. Do you want everyone in the world to have access to the database? Now at least it is hidden through obscurity. This is exactly why in this report the said journalist got it verified by three external experts, one of them a professor. >If authority has no way to audit them then how did the whistleblower arrive at th…

> Pretty simple. Do you want everyone in the world to have access to the database? Now at least it is hidden through obscurity. This is exactly why in this report the said journalist got it verified by three external experts, one of them a professor. Don't you think this is pretty convenient an excuse? The report is also not in public domain nor is the exploit. We have to just rely on a journalist, a CTO, a professor…

>> Do you have a conflict on interest with this project?

It's weird that you wrote a detailed point-by-point response to the parent post but dropped this one question.

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#144
post #53

According to the article the database has not been compromised. It's a compromise of the client which can be used to add new Aadhar entries.

The database has also been compromised in the read direction. In fact, one of the authors of this article, Rachna Khaira, got in hot water with the police earlier this year for reporting on that breach.

That's probably why this article doesn't mention it.

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#145

It is hard to believe by relying on just one source. I just checked other news sources in India, and no one has any news about any recent Aadhaar breach.

Did you read the article? It's not about a "Aadhar breach" in the sense of data being stolen. The news is about a software hack that has been doing the rounds among operators that allows them to compromise the aadhar database by introducing duplicate or weaker biometric information. "The patch lets a user bypass critical security features such as biometric authentication of enrolment operators to generate unauthorise…

There was also an Aadhar breach in the sense of the data being stolen, reported on earlier this year. By the same journalists, even!

https://thewire.in/government/data-breach-aadhaar-details-gr...

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#146

I have to admire the courage of the people who have investigated and reported this, given that the entire leadership of UIDAI and its backers in the central government are intolerant of any criticism and have been known to file police complaints[1] against journalists, critics and whistleblowers. Even its visionary and leading cheerleader from the private sector preferred to imagine conspiracies rather than acknowled…

you link anything to `thewire.in`, I would call it propaganda. The other commenter on the thread asked a question about why can't the said journalist back up the claims about a $10 app. Hate the govt all you want, but the Aadhar as you know is started by previous govt. It is if designed properly a good way to eradicate corruption for welfare schemes, so any ideas on how to do that are more appreciated than playing bl…

> you link anything to `thewire.in`, I would call it propaganda.

So you would colour everything by a certain journal with the same brush, without even looking into the reported claims? In the cited case, the content in the link (and the claim for which they were cited) is easily verified from multiple sources: [1], [2], and [3]. Even when The Daily Mail reports something outrageous and easily verified I verify it, and The Daily Mail is a tabloid.

> Hate the govt all you want, but the Aadhar as you know is started by previous govt.

This is neither here nor there. The "previous govt." was four years ago. In these four years, the current govt. — who used to claim to be staunchly against Aadhaar back then — have turned tail and zealously forced people into registering for Aadhaar and linking it with their phones, bank accounts, and even made it mandatory for kids to attend school. "But four years ago, someone else started it!" is a pointless argument when the current party has far more than enough time to fix it, or even just acknowledge the flaws.

> so any ideas on how to do that are more appreciated than playing blame game on HN.

Criticism is not a "blame game", unless the criticised turns it around and blames someone without accepting or refuting the criticism. Entertaining and listening to criticism IS a good way to improve one's product, not stuffing one's fingers into one's ears and claiming your product is the best ever and "unhackable" and filing police complaints against your critics to silence them.

----

1: https://www.livemint.com/Politics/hZGXG4q43ZeeTp2HH5QlaK/Aad...

2: https://www.tribuneindia.com/news/nation/uidai-responds-afte...

3: https://www.firstpost.com/india/uidai-files-fir-against-the-...

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#147

Earlier quoted context omitted.

> Pretty simple. Do you want everyone in the world to have access to the database? Now at least it is hidden through obscurity. This is exactly why in this report the said journalist got it verified by three external experts, one of them a professor. Don't you think this is pretty convenient an excuse? The report is also not in public domain nor is the exploit. We have to just rely on a journalist, a CTO, a professor…

>> Do you have a conflict on interest with this project? It's weird that you wrote a detailed point-by-point response to the parent post but dropped this one question.

Re-read my post again. I have clearly mentioned I don't have a conflict of interest. It's ridiculous that I even need to mention this explicitly once. And now have to reassert myself twice. I never knew having a contrary opinion automatically makes you an agent of the government. So much for "inclusiveness".

For your convenience I'll quote what I wrote in my previous comment: "It always sounds government'ish to people who rely on conspiracy theories. I am an open supporter of the Government in many policies. As far as conflict of interest with this project I am no way connected to the UIDAI project. So don't try to find connections where there are none."

Is this clear enough or you want some other proof?

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#148
post #118
post #60

Earlier quoted context omitted.

>>> Who could benefit indirectly from the breach? This and who will buy those data ? Everybody scream about the hack but I've never found a comprehensive study over how these personal data are sold, abused. Maybe to break gazillions of FaceBook/github/you-name-it accounts ? Then what, who will use those data ? Thieves ? Criminals ? If it's just that well, that's a minor inconvenience. If it's secret services of adver…

> Then what, who will use those data ? Thieves ? Criminals ? If it's just that well, that's a minor inconvenience. It's only a minor inconvenience if you can sit in a comfortable place and pontificate on Hacker News about these things. Seems like you're not even aware that people have already lost their pension money or bank account balances or didn't get food that they were entitled to and died in the process — ever…

Now I'm reading my comment again, I see how I offensed some people here. My idea was more like "globally thinking", like in "geopolitics", in that case, even a few deaths is not much (it's like people who allocate money for cancer research : they have to make sure the population is globally better; it doesn't mean every one should get out alive). And my wording was rather poor. Sorry it was absolutely not the idea I wanted to convey. Mea culpa.

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#149

I have to admire the courage of the people who have investigated and reported this, given that the entire leadership of UIDAI and its backers in the central government are intolerant of any criticism and have been known to file police complaints[1] against journalists, critics and whistleblowers. Even its visionary and leading cheerleader from the private sector preferred to imagine conspiracies rather than acknowled…

you link anything to `thewire.in`, I would call it propaganda. The other commenter on the thread asked a question about why can't the said journalist back up the claims about a $10 app. Hate the govt all you want, but the Aadhar as you know is started by previous govt. It is if designed properly a good way to eradicate corruption for welfare schemes, so any ideas on how to do that are more appreciated than playing bl…

> you link anything to `thewire.in`, I would call it propaganda.

Care to provide any reasoning why you call it a propaganda ?

Re: India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

#150
post #115
post #63

As an Indian developer, I cringe every time the government claims a system is un-hackable. Especially when contracts are handed to one of the big Indian IT companies. Having started my career in one of those companies, I saw firsthand how most of the development process was just filling in gaps. Security through obscurity was thought to be “highly secure” and security experts were non existent. No surprises that the…

You mean security experts were found all around, but patted themselves on the back after preventing a single SQL injection attack.

A single SQL Injection has pretty huge potential, specially if its in an application that deals with sensitive data. I would not downplay it.
Post reply on HN