I expected better discussion on HN (apart from sensationalist articles), the article does a poor job intentionally though.
Summary
1. Existing data is not compromised
2. Duplicate data can't be entered or overwritten
3. BUT, ghost accounts can be created easily.
Aadhar was introduced to fight ghost accounts who siphon off subsidies provided for poor. This hack/patch defeats that purpose.
I still think this is not a big problem as it looks on surface, if Enrollment software is hacked to accept iris data from photograph,
Can't the Aadhar DB (post enrollment) be scanned for all enrolled iris data with poor quality iris data and they be monitored and deleted ?
Another problem is still there, what if the operators enroll citizens from a different country as indians, essentially creating ghost accounts (from citizens of different country). i dont know how to stop such a situation.
Biometrics is never a good model for authentication, i dont know what these people were think when they designed it.
Summary
1. Existing data is not compromised
2. Duplicate data can't be entered or overwritten
3. BUT, ghost accounts can be created easily.
Aadhar was introduced to fight ghost accounts who siphon off subsidies provided for poor. This hack/patch defeats that purpose.
I still think this is not a big problem as it looks on surface, if Enrollment software is hacked to accept iris data from photograph,
Can't the Aadhar DB (post enrollment) be scanned for all enrolled iris data with poor quality iris data and they be monitored and deleted ?
Another problem is still there, what if the operators enroll citizens from a different country as indians, essentially creating ghost accounts (from citizens of different country). i dont know how to stop such a situation.
Biometrics is never a good model for authentication, i dont know what these people were think when they designed it.