A CAPTCHA test is commonly used online to verify if a user is human or a bot. Usually, these tests involve typing in a series of letters, often six, generated by the server.
However, on the UIDAI website, which verifies Aadhaar Numbers and provides user demographic data, the CAPTCHA is generated by the server but relies on client-side input for customization. This is an unusual and insecure approach.
The website's API allows users to adjust the length of the CAPTCHA. Typically set to 6 letters, it can be reduced to just 1. This greatly simplifies the CAPTCHA solving process. Moreover, if the API is heavily used, setting the CAPTCHA length to 1 makes it trivial for automated systems to solve it using simple image recognition or OCR tools.
This unconventional setup by UIDAI raises concerns about the security of their system, especially considering the sensitive nature of the Aadhaar demographic data they handle.