Its sad that it has come to this. And I half-expected this with a big country and a complicated tech solution like aadhar.
Its an identification system. Not an authentication system.
The workflow that the system was designed for was Service provider to uidai: 'hey, this guy here submitted these details for name, age, address, gender and uid number. Do all these match' Uidai: yes or no If no, call the fuckin police or shoo away the customer. Service provider when it is yes: 'hey now I need to know if this guy standing in front of me, signin up for this crazy service, is the same guy you also know he is or some other stranger trying to fake. Pls to verify identity'
At this point, uidai makes a check to see if the person has locked his biometric data. If locked, sends a OTP to him. Service provider then enters the OTP and the finger print scans using the scanner that uidai provides. Uidai responds: yes or no.
The service provider should not use the uid number to save in his records. He is supposed to create a unique account number for himself and the customer and not link uid number.
End of fucking story. Such secure. Much wow. Very private. 10/10 would do it again.
Then enter rogue state. Take a well designed tech and screw the living daylight out of it.
Designed for benefit based schemes from state to ppl, but instead made mandatory for all taxation and public sector services. Then link it everywhere. Then use it like a password or an authentication system instead of just an id. Brain == fucked. The govt shot itself in the foot by seeding doubts of insecurity and identity thefts when infact its actually pretty well designed to deal with it.
Any decent tech in the hands of a rogue state can make it dangerous. Its not aadhar's fault per-se. Its the rogue state.