Fake science in the "Science Channel"

We are now drowning in a sea of fake news.  So many whatsapp forwards that are fake, and designed to arouse passions.   Biased media, especially TV news, whose goal it is to arouse peoples  basest instincts, faking news when required (which is very often).

The latest fake news assault on science is from the "Science Channel", with its trailer about Ram Sethu being built by humans.    Most people I know who have seen it believe it totally, since they already "knew" that Ram built that bridge, and are happy to see confirmation from the West. 

What they are not aware of is, that Indian scientists have studied the geological formations and thoroughly debunked the human construction myth.   See this very well written article from the Hindu Frontline:

    http://www.frontline.in/static/html/fl2419/stories/20071005500500400.htm

But what about the amazing discoveries from the "Science Channel"?  Well, this channel has gems such as:

•  https://www.sciencechannel.com/tv-shows/unexplained-files/full-episodes/voodoo-zombies-life-after-death
• https://www.sciencechannel.com/tv-shows/unexplained-files/videos/ex-faa-official-it-has-to-be-a-ufo

It's infamous for getting TRPs in the US by fake science.    They are now doing the same in India.  Folks, don't get conned by them.

Automation of Citizen Harassment?

Our government has mandated Aadhaar update on everthing in life, and in the afterlife. Here are some examples of the joys of that process:

1) Citibank insists on updating Aadhaar for my credit card.  Their website even says:
     As per the Prevention of Money Laundering Second Amendment Rules issued dated June 1, 2017, it is mandatory to          update your Aadhaar number across all financial products, including bank accounts, credit cards and personal loans. 

  At the same time ICICI insists that there not only is there no need to updated Aadhaar, but there is no way for them to update Aadhaar for my credit card.  I checked with several people in their branch, same reply!

How can two of the major credit card companies have two interpretations of the rules?  Will credit cards get blocked on Jan 1st, when many people (including me) may be travelling and left stranded?
De-cardization?

2) Citibank offers an online portal for uploading documents for aadhaar updation.  The portal will not take documents above some tiny size, and offers no advice on how to shrink documents. 

3) Further digging shows that Citibank has an email address for sending documents.  Sent email, replies with no explanation saying:
we are unable to update your Aadhaar number on your Citi Card ending xxx due to a mismatch between information in Citi and UIDAI records. Please re-submit the request with the correct details
I can only guess that this may be because my first name is an initial with citibank, but couldn't they have given some advice?

4) Citibank also offers aadhaar update via SMS.  No reply to repeated SMSs except one message saying "We cannot process your request right now"

5) LIC has a portal, but won't let me log in with my ID.  After wasting a lot of time, I find a link saying if you are having trouble, use the old portal.  I can login there, but no link to update aadhaar.

6) Google leads me to a different site for LIC aadhaar update.  Works very nicely till the last step, where I get an error saying "GET method not supported".   GET should NOT be used for updates.  I hack the javascript source to replace GET by POST, and voila get a success message.  How can LIC release a portal where the front end does not match the backend?  What sort of testing do they do?
Will my update request work or just be ignored?  Have to wait (and wait, ...) and see.

7) My elderly housekeeper goes for Aadhaar linking for her mobile phone, but finger prints can't be read.  What is she supposed to do?  Give up on a critical resource in life?  Didn't the government (or supreme court) think about this earlier (there is some note sent recently on this topic, close to the deadline, but very unclear).  (Luckily for her, she went again and got a fingerprint read the second visit, but what about other old people.)

My conclusions based on these experiences and others: automation has made it easy for the government to force people to jump through hoops, while pathetic implementation has made jumping through those hoops extremely painful in many many cases.

We need a citizens charter of rights in this context, where citizens will not be required to jump hoops unless and until certain conditions are satisfied, such as all corner cases taken care of, and the process eased greatly for everyone.

Replay attacks with Aadhaar identification

Biometric authentication using Aadhaar is great boon for identifying people who
are physically present.   It's great to see how Aadhaar is easing the KYC process for
mobile sim card activation, which is great step forward from the present
photocopy of ID proof based methods.

However, Aadhaar cannot be a safe method for remote authentication using
untrusted devices, since biometric authentication  is clearly vulnerable to replay attack.
Here's a case where it was detected.
   
   http://economictimes.indiatimes.com/news/economy/policy/probe-against-3-firms-for-illegal-use-of-aadhaar-biometrics/articleshow/57325951.cms

It's good to see from the article that Aadhaar does have a mechanism to detect replay attacks.
But it cannot be 100% safe since attackers can store multiple scans for later attacks.
Or even just introduce minor distortions/noise into the readings, which will fool
duplicate detection.

For the longer term, even for in person authentication, one depends on trusting
the agent who is doing the verification.  Since they cannot always be trusted,
safeguards  are needed to ensure the agent is also securely identified in each transaction,
and their identity (e.g via joint photos to establish physical presence)
stored, so in case of replay attack by an agent, the identity theft victim
has some way to show  that their identity was stolen.   Without it a victim will
be in deep trouble, since there is no way to show they were not present.

UIDAI badly needs to issue guidelines for this task.
They do have some guidelines regarding trusted devices:
  http://economictimes.indiatimes.com/news/economy/policy/uidai-registration-for-all-aadhaar-authentication-devices-soon/articleshow/56734738.cms
but I don't see how they can verify if malware infects such a device.
Backup mechanisms are needed.