Reported a security issue of #Aadhaar demographic authentication API without any access restriction & was on unsecured protocols. This allows third parties to access APIs without being a AuA. Similar security issue has been previously reported. hackernoon.com/abusing-aadhaa…
If you saw demographic authentications for your #Aadhaar on UIDAI portal, but you haven't done it. It's likely a third party who is trying to verify your details. As demographic authentication does not require any permission from the Aadhaar holder
Aadhaar is truly a broken system designed by people who have no idea about Information security, apart from the vested interest to make profits from it
This issue is not the first time someone is highlighting it, but UIDAI would never accept and audit its ecosystem. The problem with UIDAI is they don't want any accountability for your information. #Aadhaar was built becuase someone else wants your Information
Demographic authentication without user's consent and permission is illegal under Aadhaar Act. But the fact that all the data is public and APIs are also unsecure, technically it's just a web request away. Law can't fix technology issues, it needs to be fixed at architecture
