Should we ask for Free Software app for UPI?

Its worth every penny and time investing in development of an open source UPI client.

UPI is common people's internet banking now. Hard to find phones without UPI apps. In these tough times, UPI is handy

Every bank has now least 2 UPI android apps their own. Then there is apps such as google pay, phonepe, paytm freecharge etc capturing markets with cashback offers and gaining monopoly.

I use UPI only via USSD (*99#) because of this very reason. I badly want libre UPI app in f-droid store.

Now that ICFOSS is out of the picture. We need to find someone else for this. Anyone have any idea about whom to contact ?

(Views are personal, and not that of my Employer).

There's a lot of open-API branding around UPI that makes this issue hard to understand. Here's a simple sketch that explains the various components (attached).

The Orange Bit is the central UPI server, which acts as the router for the other banks, which run their own servers. All of this is proprietary, running on a closed-network and inaccessible to the Internet.

An API is exposed to the actual UPI apps, which differs in its implementation across the banks. Each UPI application as a result contains:

1. Code to talk to the specific Bank API. In the case of BHIM, this is the public-facing NPCI UPI server. This involves parsing requests, responses, handling registration, etc.

2. There is the application code (red). This is the actual client-side code, say views, client-side logic etc.

3. CL, which is the NPCI Common Library. This is responsible for the same PIN screen that you see on every UPI Application. It takes care of accepting the PIN (or OTP/Debit Card) and encrypting it with the NPCI Public Keys.

4. Other code, usually third-party open-source libraries. Things like QR code scanner etc.

An effort to make a complete FOSS UPI application involves:

1. Getting NPCI to publish the CL source code.

2. Finding a bank willing to make its API schema public without getting them to bank your application.

Even if you find a bank willing to do (2), it is unlikely you can get (1) - leaving you with a partially FOSS app with a blob of sorts.

Finally, as anyone running NewPipe can attest to: none of this is technically impossible. You can always reverse 1 and 2 from any public UPI application for eg. But having one FOSS UPI application means opening a can of worms where there are infinite malicious UPI applications on the playstore.

Is there a possibility wherein a bank's api can verify the apk signature

Not at all foolproof (some bank apps try this, calculating a self-checksum and sending it to the server, but easily spoofed by sending a static checksum. This is just made easier by having access to the source), unless you use something like Google SafetyNet (not sure if this requires PlayStore).

Kerala Bank is currently not on UPI, so there might be more challenges on your way, but possibly higher rewards, since there might be chance of getting the Bank UPI Server as FOSS.

I recently announced a community-initiative to get us to an open-source UPI app. It's called LibreFin, and you can check it out at https://github.com/librefin-in.

You can also join on Gitter/Matrix: https://gitter.im/librefin-in/community, or on Telegram: https://t.me/librefin

The GitHub page has some details around the planned roadmap, which I presented at the IndiaFOSS2.0 conference a few weeks ago. (Talk will be published in a while).

@Pirate Bady There's a roadmap in place for USSD based app as well.

That's a great news. !!

It has been a while now since I dropped off the Telegram chat. Is the situation changed with the open-sourcing of UPI et al? https://dpi.global

Hasn't this become even more difficult now? It looks like even URI's like upi://pay?pa=9876543210@upi&am=101&cu=INR&tn=hundi have stopped working, probably along with the recent change to disallow money requests from UPI apps. I thought such unsigned URI's (not signed by PSP) used to work.

We have a Free Software upi app now https://codeberg.org/jiujiupay/jiujiupay It works on mobile gnu/linux. It is a simple one line shell code with *99# ussd interface behind the scenes. Works only on Airtel network. Anyone wants to take up the challenge to make it work on Android and iOS too?