India’s Aadhaar Software Hacked, ID Database Compromised, Experts Confirm

Aadhar is nothing like SSN. I wish it was. SSN doesn’t require biometrics — Aadhar takes fingerprints and iris scans. School kids don’t need SSNs to sit for their school boards. You can sit for university exams without SSNs. You can shop at Amazon without giving them your SSN[1].

[1] https://news.ycombinator.com/item?id=15796242

In fact SSN use has become more restricted over time, thanks to various pieces of privacy legislation. Meanwhile in India they still don’t have any privacy legislation last I checked, so it’s open season on your data.

Aadhar is ambitious all right — an attempt to assign every every Indian resident a number and use that number as a unique key for almost everything (public or private). The surveillance opportunities this presents is breathtaking.

Of course the good folk at India Stack love this because it enables them to build better apps. Move fast and break things, indeed.

According to the article the database has not been compromised. It's a compromise of the client which can be used to add new Aadhar entries.

Any Australian with a driver's license or passport most definitely has their facial biometrics stored. Any visitor to the country also is subject to it.

This has been in existence for over a decade and I'm astonished people aren't aware of that.

I wonder if there is a way to detect/assess fraudulent entries or will this require massive re-enrolement. Total shitstorm, WTF!!!!

I expected better discussion on HN (apart from sensationalist articles), the article does a poor job intentionally though.

Summary

1. Existing data is not compromised

2. Duplicate data can't be entered or overwritten

3. BUT, ghost accounts can be created easily.

Aadhar was introduced to fight ghost accounts who siphon off subsidies provided for poor. This hack/patch defeats that purpose.

I still think this is not a big problem as it looks on surface, if Enrollment software is hacked to accept iris data from photograph,

Can't the Aadhar DB (post enrollment) be scanned for all enrolled iris data with poor quality iris data and they be monitored and deleted ?

Another problem is still there, what if the operators enroll citizens from a different country as indians, essentially creating ghost accounts (from citizens of different country). i dont know how to stop such a situation.

Biometrics is never a good model for authentication, i dont know what these people were think when they designed it.