Hacker News Reader

Comment by dingo_bat | Hacker News Reader

Amazon is not asking for any biometrics. They are asking for your Adhaar number. The government has an authentication API that can confirm your identity for Amazon using the number. They can do this authentication by email, by phone, or by fingerprints.

This whole FUD about Adhaar is really sad to see. It's a useful service and we desperately need a national ID. Until now different things require different IDs. Voting card, ration card, PAN card, Passport, Driving license, and so on. With Adhaar we finally have the chance to move to one unique ID for every citizen. Of course like everything done by government, there are inefficiencies and bureaucracy, but it's markedly less than what we face in other IDs.

View on HN

> whole FUD

I’m sorry you can’t see the privacy implications of Aadhaar. If it’s easy to track every single place you go and every rupee you spend, it affects you in a few ways

Citizens start self censoring themselves. They subconsciously stop engaging in activities that are legal but might be traced back to them. I’ve personally done many things that I’d rather people didn’t know about. I might have dabbled in substances, for example. Maybe I might not have done that if I had known that the eye of Big Brother was watching.

You say elsewhere you’re confident that whatever the abuses of the government, we’d be able to vote them out. With the tracking ability they’ll have in a couple of years, that might no longer be possible. Who would show up to a protest if they knew the govt would be able to track them there?

Ultimately it comes down to this - Indians enjoy a lot of privacy and anonymity because they’re one amongst 1.3 billion people. Paradoxically they don’t value this much at all. Given a chance they’d gladly trade privacy for wealth. It’s not my place to say if that’s a good trade or if they should make it, but you don’t really know what you got till it’s gone.

> If it’s easy to track every single place you go and every rupee you spend

How so? How can it make it easy to trace the ₹13 cash I used to buy a cig?

> I might have dabbled in substances, for example. Maybe I might not have done that if I had known that the eye of Big Brother was watching.

How does having a UID help the government in tracking your weed smoking habits?

> With the tracking ability they’ll have in a couple of years, that might no longer be possible.

This is the point we go off the rails. You're delusional.

> You're delusional.

I'm sorry you think so. I agree that I could have made my case better, and normally I'd take a stab at it now that I have a full keyboard in front of me. But your ad hominem attack makes it not worth my time.

"Don't trade privacy for wealth" is only something you hear from people who are already living it large in wealthy countries.

I agree. Which is why I said its not my place to make judgements about people's choices in this matter.

They're not just asking for the number - they're asking for a scan of the entire card including all other details such as gender, age, and address.

What was this desperate need you talk of? Its original vision was to plug leakages and pilferage in governmental social welfare and subsidy programmes, and not as a mandatory national unique ID. It was targeted at only people who wanted to participate in those welfare and subsidy programmes, and not for every citizen.

It hasn't replaced any of the other IDs - we needed n cards earlier, we still need those n cards. If a person didn't have any intention to travel outside India, there was no mandate to go get a passport. If a person didn't want subsidized rations, there was no mandate to get a ration card. But now we need this additional n+1 card and as much additional effort to link all the others to this card. How can the effort be markedly less when it requires every citizen to get their cards linked to everything else under duress of having some service cut, but with limited service centres and their employees very aware of the opportunities to extort money from desperate people?

> They're not just asking for the number - they're asking for a scan of the entire card including all other details such as gender, age, and address.

Name, UID, gender, age, address these are not biometric info. In fact they are part of your ID.

> What was this desperate need you talk of?

I explained it in my comment.

> Its original vision was to plug leakages and pilferage in governmental social welfare and subsidy programmes, and not as a mandatory national unique ID. It was targeted at only people who wanted to participate in those welfare and subsidy programmes, and not for every citizen.

Vision and purpose can change. Nothing to worry about. Originally the purpose of cellphones was to talk and text. Now you watch Netflix on it.

> It hasn't replaced any of the other IDs

It will. Eventually there will be no need to link it to other cards because UID will be enough for everything.

I would like an option to purge my details from database. I would like to have an option to change my unique id.(i will deal with the mess of re-auth)

> I would like an option to purge my details from database.

You can't. Just like you can't delete info from the RTO databases.

Can't now. What if there is a law?

I don't think it's FUD. I have a few questions. Can we confidently say that the database won't ever be hacked in the future? Are we prepared to face such situation? Would the government let you know if the database ever got hacked? What guarantees do we have that the politicians won't use it for their advantage?

> Can we confidently say that the database won't ever be hacked in the future?

No, that would be a ridiculous thing to be confident about.

> Are we prepared to face such situation?

I hope so. I have trust in this admin a bit more than previous ones. But long-term, I don't know.

> Would the government let you know if the database ever got hacked?

They are bound to respond to an RTI inquiry.

> What guarantees do we have that the politicians won't use it for their advantage?

None, just like anything else. Just the assurance that we all get to vote them out if we want.

To provide a bit of reality check in relation to your answers:

1. This Govt. has, in a recent affidavit to the Supreme Court, claimed the Aadhaar database has never been hacked.

2. Other government agencies — including state governments and the National Informatics Centre have made Aadhaar details and data public, or accessible publicly.

In the case of the National Informatics Centre, supposed to be "the premier science & technology organisation of Government of India in informatics services and information and communication technology (ICT) applications" and is "a part of the Indian Ministry of Electronics and Information Technology's Department of Electronics & Information Technology", an API proxy to the Aadhaar eKYC service was made available on the public internet:

i. With an HTTP, not HTTPS, endpoint;

ii. With a single auth-token, used for all calls to this API proxy, embedded in an Android app the NIC put out;

iii. That was abused publicly by someone for their Android app providing access to "demographic data like name, address, phone number of individuals" without any authorization required.

3. There are no existing data privacy laws. There are no laws to punish, or even state what can be done, in situations of data breach.

4. The Govt. is just now in the beginning stages of forming data protection laws.

> 1. This Govt. has, in a recent affidavit to the Supreme Court, claimed the Aadhaar database has never been hacked.

> 2. Other government agencies — including state governments and the National Informatics Centre have made Aadhaar details and data public, or accessible publicly.

So that means the government has been truthful? As soon as they start lying we'll have the recourse of suing. Don't worry.

Ineptness of government agencies is there in everything. Trains run late and the bathrooms smell. Doesn't mean we need to shut it all down. We carry on and try our best to improve things. Laws will slowly but surely catch up. Enforcement will catch up. This is the only way we can progress.

> So that means the government has been truthful?

I made no such assessments; I only laid out the facts as I found them. If you ask me for such an opinion, I'd call it technically correct and disingenuous; like claiming the left hand didn't steal what the right hand did, when the person themself is suspected of thievery.

> Laws will slowly but surely catch up. Enforcement will catch up.

Sure. But the mad rush to get everyone on the system by force should come strictly after these.

> Doesn't mean we need to shut it all down.

I did not call for anything in the slightest to this effect. I was merely laying out the facts.

With regard to point 3, the disclosure of aadhar data can result in prosecution, but the prosecution can only be done by the Aadhar agency.

The agency itself disclosed Aadhar data at some point, so it remains to be seen if they will take themselves (or anyone at this point) to court.

> The agency itself disclosed Aadhar data at some point

Source?

> They are bound to respond to an RTI inquiry.

Their past behaviour has not been good [1].

Trust is the whole problem. Many like you trust this government (why is something I can't understand, other than their effective propaganda, but let's leave it at that). But there are many who don't. It's not just about privacy, it's also about things like fear, religious profiling, autocratic tendencies, curbing of freedoms. It's also not about just the current government, but of governments to come. A non-mandatory aadhar would give those who don't trust the system a choice to remain out of its programmes and perhaps voluntarily pay higher costs or forego any benefits. But this government has not given any such choice. It's deeply discomforting to be forced to give all this information to an entity one doesn't trust.

[1]: https://thewire.in/146791/uidai-invokes-national-security-re...

As I stated elsewhere in this thread -

Treating the Aadhar authority as a partisan object is to make a mistake.

It was conceived by the Congress, and as an agency, it is designed to survive all normal parties which come to power.

It is more an arm of the Government of India, its bureaucracy and underlying machinery - than a political function of whoever is the ruling party at the time.

To discuss of it in terms of parties, is to pretty much fall into one of its defensive design patterns - because this agency is designed to appeal to any party in power.

A significant amount of design and political thought has gone into this agency, and in the way it has strategically expanded its remit and powers.

In short - UIDAI was designed from to avoid the political pitfalls of modern India and exist forever.

Its only real weakness is scrutiny of its results and methods, and its eventual necessity to handle actual crisis.

Do note, that this has already been planned for, because the Agency is designed to push responsibility away from itself, - instead it gives people the ability to use their APIs and take the responsibility on themselves.

>this admin.

Please do not make the mistake of conflating the ruling party with the machinery of the Government of India.

Aadhar is a child of the GoI. It has enjoyed support by both parties, and was the brainchild of the previous Majority member in the coalition.

I assure you, that any and all hopes vis-a-vis aadhar, placed on the ruling party are in vain.

This is exactly the kind of scenario that Americans would be afraid of - a shadowy government organization, which runs constantly, despite any person or party who is in or is not in, power.

That is what the Aadhar authority is, and always has been.

They have a product they can offer all successive governments, which will ensure its continued survival.

The party in power is irrelevant.

I know how partisan political discussions get, which is why I am highlighting this point. IT doesn't matter who is in power.

> IT doesn't matter who is in power.

Agree 100%. Adhaar is good for the people no matter who is in power.

Reply on news.ycombinator.com