4 ms·

On that note though, while you up the convienence, you also lower the security. Passive RFID can only broadcast a number; there's no compute to adhere to any so

On that note though, while you up the convienence, you also lower the security. Passive RFID can only broadcast a number; there's no compute to adhere to any sort of security protocol that is resistant to replay attacks. Meaning anyone with a reader that passes close enough to you will have the keys to your house.

theandrewbailey 8y ago
"Hey, can you take a picture of me and my friend?" Later: "My phone got his RFID. Let's clean him out."
mseebach 8y ago
Parent said simple, not passive. Non-passive RFID is still simple.
- lostcolony 8y ago
  From parent, "they don't even have a battery". Maybe my definition is off, but doesn't that mean passive? I.e., requires an antenna to activate it via an RF discharge, and then with that minimal charge it broadcasts back its identifier.
  - woodrowbarlow 8y ago
    you're right, i did mean passive. something like [1]. i don't claim that they are a particularly secure solution. i only wanted to dispute the implication that they enable GPS tracking. [1] https://dangerousthings.com/shop/xm1-plus/ https://dangerousthings.com/shop/xm1-plus/
ThrowawayR2 8y ago
> Passive RFID can only broadcast a number Nope, not anymore. Current UHF RFID tags are able to store enough charge from the RF signal from the reader to have a half-duplex conversation with the reader and do small amounts of computation. See https://www.iso.org/obp/ui/#iso:std:iso-iec:18000:-63:ed-2:v1:en https://www.iso.org/obp/ui/#iso:std:iso-iec:18000:-63:ed-2:v...
- lostcolony 8y ago
  Cool! Has anyone shown that a subdermal sized RFID chip is able to adhere to that? Further, does any RFID chip on the market have a real security story? Ideally you'd have public/private key encryption with some programmability on the part of both the readers and the chips themselves (so readers can be told "here's the public key of ID#1234, so only trust that you've seen 1234 if you get something decryptable with this key", so they can't be easily spoofed, and RFID chips can be told "here's the public key of the reader(s) you should respond to; anyone else ignore"). Until that happens, I just don't see it being secure.
  - ThrowawayR2 8y ago
    > Further, does any RFID chip on the market have a real security story? A few minutes of Googling would have told you that, yes, such things already exist and have for a while. Slap one into a implantable tag and you're done.

theandrewbailey 8y ago

"Hey, can you take a picture of me and my friend?" Later: "My phone got his RFID. Let's clean him out."

mseebach 8y ago

Parent said simple, not passive. Non-passive RFID is still simple.

lostcolony 8y ago
From parent, "they don't even have a battery". Maybe my definition is off, but doesn't that mean passive? I.e., requires an antenna to activate it via an RF discharge, and then with that minimal charge it broadcasts back its identifier.
- woodrowbarlow 8y ago
  you're right, i did mean passive. something like [1]. i don't claim that they are a particularly secure solution. i only wanted to dispute the implication that they enable GPS tracking. [1] https://dangerousthings.com/shop/xm1-plus/ https://dangerousthings.com/shop/xm1-plus/

ThrowawayR2 8y ago

> Passive RFID can only broadcast a number Nope, not anymore. Current UHF RFID tags are able to store enough charge from the RF signal from the reader to have a half-duplex conversation with the reader and do small amounts of computation. See https://www.iso.org/obp/ui/#iso:std:iso-iec:18000:-63:ed-2:v1:en https://www.iso.org/obp/ui/#iso:std:iso-iec:18000:-63:ed-2:v...

lostcolony 8y ago
Cool! Has anyone shown that a subdermal sized RFID chip is able to adhere to that? Further, does any RFID chip on the market have a real security story? Ideally you'd have public/private key encryption with some programmability on the part of both the readers and the chips themselves (so readers can be told "here's the public key of ID#1234, so only trust that you've seen 1234 if you get something decryptable with this key", so they can't be easily spoofed, and RFID chips can be told "here's the public key of the reader(s) you should respond to; anyone else ignore"). Until that happens, I just don't see it being secure.
- ThrowawayR2 8y ago
  > Further, does any RFID chip on the market have a real security story? A few minutes of Googling would have told you that, yes, such things already exist and have for a while. Slap one into a implantable tag and you're done.