Tag Archives: security

Passport Office Website Can Share Your Personal Information

If you are filling up the online form at Passport Office’s website for a new passport or for renewal, please pay close attention to the last field before the Submit Button.

One of the option there states that:

“I authorize Passport Seva to share my name and contact with companies that offer financial, travel & tourism products, where such companies may offer special schemes for passport applicants from time to time. With my consent as YES, i agree to override the Do-Not-Call (DNC) mandate for the communication I may receive from them

While the check box has further information on what information is shared: “YES, share my name, contact, gender, date of birth, application type and education qualifications with  <the advertiser/third-party service provider changes with the time, check the screenshots below>”

In my opinion, this is a bad feature and am very apprehensive of the fact that Passport office provides an option to share our personal information with Third Party providers. I am wondering who gave them the idea to monetize on our private information, of course this is a opt-in but still. What more that the list of Vendors changes with the time. I had taken the screenshot a few months back and again revisited the page to check, but this time it showed a different service provider! Once these information is shared, we do not have any control on how it is stored and used. My recommendation to Passport Office is to stop sharing these information at the earliest, with or without choice, and if you are filling the form, ensure you select Do Not Share option.

The below screenshot was taken few months back, it was TATA AIG for Life Insurance then:

passport_office India privacy_selection

Currently the vendor is listed as Chola-MS for Chola Shubh Yatra Travel Insurance:

passport_information_thirdparty

 

I tried giving feedback at the passport office site here. But there is no way to proceed unless one provides the file number and other details!

How Browsers Handled Website with Revoked SSL Certificate

This incident of unauthorized Digital Certificates relating to Google issued by Indian CA has caused quite a scare among netizens. While we have to wait for the exact causes of this incident, I just thought of seeing how browsers handle websites with revoked certificates. The browsers I tested were Chrome, Internet Explorer, and Firefox. The website was:

https://nicca.nic.in/

While NIC CA’s website mentions that all Certificate issuing Operations have been shutdown for sometime , it still continues to use the invalid certificate.

Date 3rd July 2014 

Due to security reasons NICCA is not issuing certificates as of now. All operations have been stopped for some time and are not expected to resume soon. DSC application forms will not be accepted till operations are resumed and further instructions will be issued thereafter. Inconvenience caused is regretted. 

Here are the results with screenshots:

Chrome Version 35

Of the three browsers tested, Chrome stood out from a security perspective for its users by providing detailed information on why the connection may not be secure and also NOT providing an option to override and access the affected website. Clicking on More button provided technical details with regards to certificate information (revocation details in this case)

Revoked SSL Certificates Handling by Chrome

 

chrome ssl revoke details

Firefox Version 30

Firefox too provided detailed information on why the connection is untrusted. However Firefox also provided an option to ignore the warning, add an exception and continue to browse to the site. It would have been good if Firefox had blocked the Security Exception function and not allow the loading of the site. Not good practice in my opinion.

Firefox handles revoked SSL Certificate

 

firefox override ssl_revoke

 

NIC CA website

Internet Explorer Version 11

Of the three browsers, Internet Explorer provided the least technical information when trying to access the site with invalid certificate. All it says is the Certificate is revoked and even clicking on the More Information button hardly provides any details and instead directs to a IE help, which I could not figure out. However like Chrome, IE too did NOT  provide an option to add an exception and continue to browse, which is good from a security perspective.

Internet Explorer SSL Revocation