About me

The truth is that I am still struggling to figure my Self out. Nevertheless, I work at an institute of higher education based in India (my job description says that I'm supposed to be a teacher primarily). From my posts here you may form a particular impression about me which may or may not be different from the one you would have carried in case we have met in person. At any time you are seeing only an incomplete picture of me -- the one which I have, consciously or unconsciously, chosen to present. Views expressed in my posts here do not necessarily reflect the views of any entity with which I may be associated.


What is Gtungi (गतूँगी)? It means nothing. The word gtungi exists in few local dialects in India, and in some cases it is used to address a toddler.

Popular posts from this blog

Implementing a secure contact tracing system

Contact tracing means identifying people who have been in close proximity to each other for a certain duration of time. In recent days the COVID19 pandemic has brought this topic into the attention of governments trying to contain the outbreaks of the disease. However, there have been widespread concerns about the user’s data and privacy being compromised via the contact tracing app. The following report provides a useful database and analysis of the currently available apps that do contact tracing: https://www.technologyreview.com/2020/05/07/1000961/launching-mittr-covid-tracing-tracker/ As can be seen from the above report, a large chunk of those apps are considered invasive and do not clearly outline how they actually work, and what they do with the potentially sensitive data that they capture from the user’s device. A possible design for a transparent and secure contact tracing solution The Bluetooth and GPS enabled smartphones carried by the population are the most commonly used d
Read more

Data leakage possibilities with Aadhaar based e-KYC systems

Image
A recent incident in July 2017  that involved alleged data theft through a KYC app has added to the confusion and concerns in the minds of users about security and confidentiality of their biometrics and other PII data that are maintained by UIDAI . I am a bit skeptical about how PII is handled by various agencies who collect and transact with such data in our country. The concern about having my biometrics and other data lifted was at back of my mind when I was giving my fingerprint at a mobile phone shop for taking a new data connection last week. It was not until a friend asked me for some clarifications about internals of biometrics based authentication systems that I paid close attention to various possible leakage points in Aadhaar based eKYC/authentication  applications.  The overall architecture and process steps involved when using Aadhaar APIs for performing, say, authentication of an Aadhaar card holder are explained in its API documentation . For the sake of und
Read more

Opprtunities for improving security in GoI apps

Image
Recent nationwide lock down due to COVID19 situation has forced me to try using some of the apps designed by various agencies of the central and state governments in India. It is heartening to see that we have done some serious work towards adoption of digitization of several services. The apps that I tried using included: BHIM by National Payments Corporation of India (NPCI) https://play.google.com/store/apps/details?id=in.org.npci.upiapp&hl=en_IN Aarogya Setu by NIC (https://play.google.com/store/apps/details?id=nic.goi.aarogyasetu) Interestingly, both of these apps came into being in response to a crisis situation. The BHIM system came into limelight after the November 2016 demonetization event. Aarogya Setu is believed to be an app for tracing COVOD-19 contacts of the people who may be infected by the virus. Lets talk about the BHIM app first. It seems to have matured today, and has a wide user base. The permissions required by BHIM app for its functioning are listed here unde
Read more