India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

Post by kcsomisetty » Tue, Sep 11, 2018, 5:43 PM UTC

pritambaral wrote: post #105

kcsomisetty wrote: post #100

Earlier quoted context omitted.

Aadhar is not a client side authentication, what is client side even mean in this context ?

Please read TFA: "The patch lets a user bypass critical security features such as biometric authentication of enrolment operators to generate unauthorised Aadhaar numbers." The client here is the enrollment software, not "Aadhar" (whatever you meant by that). The Aadhar service should haven been authenticating enrollment operators on the server side, instead of relying on the enrollment software to verify identity (t…

Post by [deleted] » Tue, Sep 11, 2018, 5:51 PM UTC

kamaal wrote: post #69

Karupan wrote: post #63

As an Indian developer, I cringe every time the government claims a system is un-hackable. Especially when contracts are handed to one of the big Indian IT companies. Having started my career in one of those companies, I saw firsthand how most of the development process was just filling in gaps. Security through obscurity was thought to be “highly secure” and security experts were non existent. No surprises that the…

No amount of 'security' will help here. That's because every one including the people don't give a dime about 'security' in India. In Aadhar enrollment centers, passwords are shared. You might like to introduce an OTP like concept, but phones are shared too. 2FA? nice try, but then people also share answers to security questions. Next what? DNA authentication? Biometrics? guess what none of those are any where near r…

Post by ppurka » Wed, Sep 12, 2018, 1:51 AM UTC

intended wrote: post #124

amf12 wrote: post #88

Earlier quoted context omitted.

> There are three people across three different parts of the world who corroborate the report - CTO of a global technology group, a security based analyst and a professor of Computer Science. I wonder how this is "sensationalist". OP is not negating the problem. However, the title implies that the existing database has been breached, which is not true. Author could have given a better title which implies that ghost e…

The whole point of the system is to give a single confirmed Identity for citizens of India. at this point the purpose of the exercise has been voided. Saying that "the data has not been compromised" is a red herring, thats the case for when our biomterics are lost and our privacy breached which is a whole different issue with this database, one among many of its other problems. At this point if the data is crud, what…

Post by iamshs » Wed, Sep 12, 2018, 5:32 AM UTC

kkarakk wrote: post #131

Aeolun wrote: post #111

Earlier quoted context omitted.

I mean, you need a client to access it, and presumably having a patch for such means you have the client too...

aadhar card operators get paid 30ruppees an hour. i'm sure you can get access to a client pretty easily

Post by lenkite » Wed, Sep 12, 2018, 9:26 AM UTC

ppurka wrote: post #155

intended wrote: post #124

Earlier quoted context omitted.

The whole point of the system is to give a single confirmed Identity for citizens of India. at this point the purpose of the exercise has been voided. Saying that "the data has not been compromised" is a red herring, thats the case for when our biomterics are lost and our privacy breached which is a whole different issue with this database, one among many of its other problems. At this point if the data is crud, what…

Actually, having an Aadhar number does not imply that the person is a citizen - this is one of the statements present in the application form itself. So, it is possible for non-citizens to have an Aadhar number.