NRIC and the loophole
NRIC and SingPass loophole
On February 2024, I reported a loophole through OneService regarding the CPF eCashier order. I was alarmed to discover that I could enter someone else's NRIC and log in with my own SingPass, allowing me to view their income. It took five months for the issue to be resolved and a new eCashier order format to be implemented.
This experience made me realize that as long as there's a platform that allows NRIC entry, SingPass can be used to access sensitive information, regardless of whether the NRIC belongs to the user.
I want to bring attention to this matter, as the government is considering making NRIC numbers public, yet we're unsure if there are other similar loopholes in our system.
NRIC and SingPass loophole
On February 2024, I reported a loophole through OneService regarding the CPF eCashier order. I was alarmed to discover that I could enter someone else's NRIC and log in with my own SingPass, allowing me to view their income. It took five months for the issue to be resolved and a new eCashier order format to be implemented.
This experience made me realize that as long as there's a platform that allows NRIC entry, SingPass can be used to access sensitive information, regardless of whether the NRIC belongs to the user.
I want to bring attention to this matter, as the government is considering making NRIC numbers public, yet we're unsure if there are other similar loopholes in our system.