That might not have been an oversight. Having designed the RFID tag system for a conference before, there's a real cost difference between crypto-capable NFC t

That might not have been an oversight. Having designed the RFID tag system for a conference before, there's a real cost difference between crypto-capable NFC tags and ordinary ones, once you factor in the number of badges you need to print. Then consider that (a) the conference probably has very little budget for an RFID implementation, and (b) the NFC tag isn't used for anything that's security-sensitive -- mostly checking in at vendor booths, attendance tracking, etc. Given that, I can totally understand why RSA didn't use something more secure. The BIG fail here is that the towel manufacturers didn't toggle the read-only fuse in the tags, which allows them to be overwritten by anyone with an Android smartphone.