Bruteforcing is totally doable because in practice the unique identifiers broadcasted by these tags are allocated sequentially. I built an AVRFID a few years ag

Bruteforcing is totally doable because in practice the unique identifiers broadcasted by these tags are allocated sequentially. I built an AVRFID a few years ago to bruteforce the HID ProxCard II RFIDs at work (45 bits of data: 20-bit mfg ID, 8-bit facility ID, 16-bit tag ID, 1 odd parity bit). Starting from my ID, and incrementing it one by one, it only took seconds to find many other valid IDs that were unlocking doors of various restricted areas. Imagine a disgruntled employee who has his legit RFID and is looking to access other restricted areas to which he normally doesn't have access... bruteforcing works perfectly fine for him.