You Will Soon Have To Verify Your Face For Aadhaar Use, Four Reasons Why That's A Very Bad Idea

The Unique Identification Authority of India (UIDAI) is set to introduce face authentication in a few months, alongside iris and fingerprint scanning.

In a statement to the Supreme Court last week, UIDAI CEO Ajay Bhushan Pandey indicated the new feature would be debuted July 1, 2018.

The thing is, that¡¯s a very worrisome prospect. After all, the Aadhaar system and its components haven¡¯t really proven that they¡¯re secure in the slightest. There are so many ways this can go wrong.

The bad reference data

It¡¯s been indicated that face recognition will only be used in ¡°fusion mode¡±, meaning it¡¯ll only be acceptable alongside one of the other existing authentication methods - fingerprint, iris scan, or OTP. ¡°The UIDAI has decided to enable face authentication in fusion mode on registered devices by July 1, 2018 so that people facing difficulty in other biometric authentication (fingerprint and iris) could easily authenticate.¡±

That¡¯s great and all, since two-factor security is always better. The problem is that UIDAI has no intention of mapping people¡¯s faces for this facial recognition tool. In fact, the group believes there¡¯s no need to capture any additional reference data, seeing as user¡¯s photos are already stored on its Central Identities Data Repository (CIDR).

Reuters

Do you know why facial recognition didn¡¯t really sell well in smartphones until the iPhone X? That¡¯s because pre-existing facial recognition technology using regular cameras was rudimentary and easily beaten by holding up a photo to the camera. Obviously, it¡¯ll be even worse when the reference itself isn¡¯t a 3D map of a person¡¯s face, but instead a 2D photograph. Look at the photo on your Aadhaar card taken with a crappy webcam. Do you really want to trust a system that verifies your ID with that?

The workarounds

Remember how much Apple touted FaceID as being accurate and secure? Well, it wasn¡¯t too long before people noted how their look-alikes and their relatives were unlocking the device. As for security, well, hackers broke through that just a week after the iPhone X was launched. Can you imagine how insanely easy it would be to break Aadhaar¡¯s facial recognition method by comparison? After all, there¡¯s no IR mapping of facial topography going on, just image recognition from that photo. Also, there¡¯s probably a lot more incentive for malicious actors to steal your Aadhaar data than unlocking your smartphone.

The misfiring redundancies

And if the facial verification is working in tandem with other identification modes, there¡¯s another problem. If someone can steal your photo or fake your face for verification, they can certainly steal your phone to access the OTP needed. In most cases, your password isn¡¯t even going to keep them away from that, considering most people leave notifications like that visible from the lock screen.

The unsafe data storage

There¡¯s also the fact that Apple had one advantage for its system. All facial data for FaceID was being saved locally, so a hacker couldn¡¯t steal your biometrics by hacking into your iCloud. In the Indian government¡¯s case, all your facial data is coming from the photo in UIDAI servers remember? And all of that precious data is apparently so secure because it¡¯s being protected by ¡°13-feet-high walls¡±. Yeah, for real, we aren't making this up.

So, until we get a little more clarity, it¡¯s probably safe to say that facial verification for Aadhaar is a bad idea. Maybe in future UIDAI will be able to detail a better security system, or talk about other plans to protect your data.

But until that happens, if you opt for this kind of security, chances are it won't be secure for too long.