Hacker News Reader

Comment by rahuldottech | Hacker News Reader

When I first (mis)read the title, I had a mini heart attack, thinking that the govt was going to hand over a lot of personal data to private companies.

Instead, it appears that they're trying to give citizens more access to and control over their data which seems nice.

That said, the Indian government really don't have a great track record of securing citizens' data. I hope they do a better job this time.

This is the brainchild of Nandan Nilekani. He also developed UPI and Aadhaar. The former is amazing. The latter is... controversial at best. But they really fudged up user privacy, and essentially "tricked" millions into giving up their biometrics and personal info - which were then leaked, stored on US servers, etc. :(

Let's hope they've learnt from their mistakes.

More info about Aadhaar "scandals":

[1]: https://www.firstpost.com/tech/news-analysis/aadhaar-securit...

[2]: https://m.timesofindia.com/city/hyderabad/tdp-app-keeps-aadh...

View on HN

A major problem with Aadhaar is how UIDAI has completely discounted the fact that Aadhaar will be used by people who have zero idea about technology/computers. "Most" of the scandals with Aadhaar has been social engineering to gain access or clueless government officials printing the data and putting it up publicly on their department websites.

99% of the cases I see is humans being completely inept at handling data - most of them probably don't even realize the implications of such a central repository of data.

Fortunately, UIDAI has made some improvements. You can lock your biometric authentication and every request to verify will fail until you unlock for 10-15 mins. They have implemented a virtual ID over Aadhaar which can be used for verification without handing over your original number - but here's the problem, institutions have no idea that these numbers are valid too!

I do believe that a system like Aadhaar is necessary for India BUT govt institutions like UIDAI cannot and should not declare their end of responsibilities at just the technical level (which UIDAI frequently does by claiming that data is housed in secure vaults and encrypted and blah blah). If you build a system which will be responsible for a billion lives, you are also responsible for teaching people safety and enforcing requirements which minimise, if not eliminate, social engineering.

At the end of the day, you are a government institution, not a company.

The technical side of Aadhaar is also incredibly inept. There is several days worth of reading material at https://medium.com/karana.

> This is the brainchild of Nandan Nilekani. He also developed UPI and Aadhaar. The former is amazing. The latter is... controversial at best.

UPI is one of the shadiest thing ever. A non profit whose owners are unknown built a suite of technologies and UPI was one of them. I think they did not even build it, it was built by some for profit company and non profit was a front to pimp this idea to government. When India went through the horror show of demonetization the government forced all the banks (most of which I government owned) to implement UPI, these banks who can not develop a webpage without getting their panties in twist suddenly had UPI stack working for them within few weeks (India's largest bank is SBI and their homepage is named mypage.htm, they do not allow ' $ and " in their passwords because they are "hacking characters").

Some people who work with the non-profit Indiastacks were in bay area recently trying to earn some silicon valley creds to pimp this to African countries.

UPI is great and works well but I am not sure the backstory is clean.

Reply on news.ycombinator.com