11 ms·
Tiny, tamper-proof ID tag can authenticate almost anything
- weebull 3y ago...but is it Tinie Tempah proof?
- musiciangames 3y ago> A counterfeiter could peel the tag off a genuine item and reattach it to a fake, and the authentication system would be none the wiser. So you bought a genuine item to get its tag, don't you now have a problem of what to do with your genuine item? Sell it with fake ID?
- BirAdam 3y agoIf the purpose is to get a fake device somewhere for nefarious purposes such as bombings, surveillance, network infiltration, or some other purpose people would do it. Yes.
- kvdveer 3y agoThere's several ways the original ID-less item is not a problem: * The attacker might have physical access to the genuine item, but not have ownership of it. A counterfeit seller might peel of stickers in a legitimate store, and use them in the fake store. Walking out with a bunch of stickers in a Farraday cage is a lot easier than walking off with the actual merchandise. The original retailer is then stuck with an unauthenticatable genuine item. * The attacker might transplant a sticker from a defective genuine item (e.g. in a repair shop) to a counterfeit item. The genuine item was already worthless at this point. * The attacker might transplant a sticker from an authorized object (e.g. locked suitcase that has passed inspection) to an unauthorized object (e.g. locked suitcase with contraband). The original object can then be discarded. This tech would prevent each of these attacks (should it prove pracical)
- sparsely 3y agoDepending on the article it might still be possible to detach/reattach the tag without damaging the glue interface (e.g. it's on the casing of expensive devices, or fabric etc)
- metalrain 3y agoDoes this technique have shelf life? Like glue degrades and then even non-counterfeit product becomes invalid?
- sebstefan 3y agoThat was my worry also, that and rain, humidity or heat
- denton-scratch 3y ago> terahertz waves, which are smaller and have much higher frequencies than radio waves. Strange language, this journalist uses. "Terahertz waves" are radio waves, although they're more commonly called far-infrared. It's not clear to me what the tag itself does, apart from the glue. Apparently it serves only to hold the glue in place, and so is 100% redundant. Or perhaps the talk about "slots" explains the purpose of the tag: it sounds like a grating, but the article doesn't explain why you need a grating.
- samatman 3y agoRadio waves are, by convention, EM radiation at 300GHz and below. Terahertz is EM radiation from 300GHz to 3THz. These ranges do not overlap.
- bArray 3y ago> This tiny tag, which offers improved security over RFIDs, utilizes terahertz waves, which are smaller and have much higher frequencies than radio waves. But this terahertz tag shared a major security vulnerability with traditional RFIDs: A counterfeiter could peel the tag off a genuine item and reattach it to a fake, and the authentication system would be none the wiser. Instant defeat of this device: Manufacture a tag that returns the signature of a known legitimate tag. In order to be useful it would need to be challenge and response. Maybe they do this, but this MIT release doesn't actually give any link to a paper which is super annoying. > Their antitampering tag contains a series of miniscule slots that enable terahertz waves to pass through the tag and strike microscopic metal particles that have been mixed into the glue. Another issue: You would figure out how to destroy the connection between the material and the glue whilst leaving the surface of the chip intact. You would then simply re-attach it using another glue without particles in it. > But when it came time to test the antitampering tag, Lee ran into a problem: It was very difficult and time-consuming to take precise enough measurements to determine whether two glue patterns are a match. > He reached out to a friend in the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) and together they tackled the problem using AI. They trained a machine-learning model that could compare glue patterns and calculate their similarity with more than 99 percent accuracy. As others have pointed out, this is a bad idea. You'd want some form of a probabilistic hash and for that to be stored in a database.
- pbmonster 3y ago> Another issue: You would figure out how to destroy the connection between the material and the glue whilst leaving the surface of the chip intact. You would then simply re-attach it using another glue without particles in it. That was my first thought. If that's on a banknote, you'll have people cutting the paper around the tag and gluing it to the counterfeit, including the old paper it sticks to. This means you already need to look at the "watermark" again, you can't just read the tag. Add some micromechanical sanding/grinding, chemical etching or laser ablation, and not only can't you read the tag with an antenna, but you need a microscope to look at - and a spectrometer, to look at the glue. > As others have pointed out, this is a bad idea. You'd want some form of a probabilistic hash and for that to be stored in a database. I think the reason they went with ML to do pattern recognition is because the THz response of the tag is a finicky analog signal, which might change in fundamental ways if you do things like reposition the antenna, or change what's in front/behind the tag. The problem is probably pretty similar to identifying whether two images are similar in the special case where you allow pretty significant distortions to one of the images. Hashing usually doesn't work to well for cases like that, but maybe a wavelet transform approach would work.
- bookofjoe 3y agodup: https://news.ycombinator.com/item?id=39430052 https://news.ycombinator.com/item?id=39430052
- eadmund 3y agoOTOH, online authentication doesn’t necessarily even need a tag at that point, right? If invisible or at least imperceptible the particles could just be permanently applied.
- userbinator 3y agoThank you for adding more DRM to our lives.
- apgwoz 3y agoIf this can help ensure that I have, say, an authentic pacemaker, and not a counterfeit, I’ll accept it.
- rvnx 3y agoI think it will help your device to know whether you are using authentic HP cartridges or Nespresso capsules.
- apgwoz 3y agoThat’s already happening. If companies want to be assholes, we should boycott the company and demand they change. Things are worse than printer ink. Soon, I’ll have to subscribe to turn the heat on in my car. I still want an authentic pacemaker.
- contravariant 3y agoThis is more like publishing hashes of a file you download. You can use it to verify the identity of an object, but that's it. This differs from DRM in a fundamental way, namely that you are not required to do this. You can choose to ignore it if it turns out the object isn't authentic. Whereas DRM relies on making you enforce certain rules, and putting technological or legal barriers in your way to prevent you from breaking them.
- timeimp 3y agoProvenance != DRM. The ability to prove the origin of something over "Source: dude trust me bro" is critical to a great number of people. But sure, let's stick with "yeah nah, this piece of paper says what's in the box is in the box so it must be legit" because FOSS is gonna get salty about this.
- 3y ago
- stavros 3y agoWhat else causes this pattern to change? Time, or light, perhaps?
- ukd1 3y agoI was wondering if degradation of the glue might too. Also, presumably this only works on solid surfaces - i.e. things that flex (clothes? ...glass?) might not work as the pattern might change over short/long periods of time too.
- nonrandomstring 3y agoHeat and vibration. to quote this thread, which someone seems determined to bury for some reason https://news.ycombinator.com/item?id=39424773 https://news.ycombinator.com/item?id=39424773 "The issue not mentioned is one I've encountered in other similar projects which is false negatives cause by "creep" in plastics and general thermoplastic movement. We had a near-UV scanner that could map the surface of a test object (sensitive circuit boards) down to a few wavelengths, but it was too damn accurate. Go back and scan the same object a week later and stuff (like solder joints) has moved naturally. That doesn't work when things are in transit for weeks with vibrations and temperature variations"
- ghusbands 3y ago> which someone seems determined to bury for some reason People may be downvoting the top message because it contributes nothing. It doesn't require some nebulous malicious actor somehow trying to keep you down.
- nonrandomstring 3y agoWell, this meta speculation about people's machinations is generally unhelpful anyway. But my claim was somewhat different; that the same article was spammed to HN three times in a 24 hours. I was surprised it wasn't flagged as a dupe and merged, which meant only the slight inconvenience that my earlier relevant comment had to be copy-pasted.
- BMc2020 3y agoterahertz waves, which are smaller and travel much faster than radio waves. Well raise my rent.
- mikercampbell 3y agoI literally gasped after reading the synopsis. It is such an incredible idea, that seems strangely (and probably wildly incorrectly) simple.
- rvnx 3y agoMaybe they mean FM waves by "radio" ? (which would then imply, "FM waves" versus "terahertz waves") But I agree it sounds funny. A bit like, "we found faster than electromagnetic waves: we are using light"
- giantg2 3y agoThey probably mean faster as in transmitting data more quickly than with lower frequency. The EMR travels at the same speed, but you get more throughput.
- munchler 3y agoTalk about burying the lede. We've discovered faster-than-light communication... and we're using it to make tamper-proof ID tags.
- 3y ago
- tsergiu 3y agoWhat prevents somebody from scanning it and reconstructing the position of the metal pieces? Perhaps a better solution is to create a small chip powered by electric induction. The chip would have an embedded private key and solve challenge-response queries issued by the scanning device. I'm not sure how that compares in cost though. Edit: it looks like these already exist and cost less than 10 cents a piece. They are called NFC tags.
- eemil 3y agoWhat prevents you from scanning & reconstructing a bucket of rice? :)
- wenyuanyu 3y agoI don't know if I understood correctly. But it might be that the metal pieces in glues are pure random process, and there are no way to reproduce or re-print it again. The metal pieces are then recorded as a key in central database or some sort of AI, just like human fingerprint or retina how are collected and used for authentication???
- landr0id 3y agoIt says in the article that the idea behind this implementation is that if the tag is swapped it breaks the authentication since the glue is involved in authenticating. NFC/RFID chips can just be swapped from a real product to a fake one as-is. >What prevents somebody from scanning it and reconstructing the position of the metal pieces? You're talking about very, very small pieces of metal whose position/orientation is not deterministic when laying the glue and that information is combined with the tag itself to present some kind of challenge response.
- tonyarkles 3y agoYeah if I’m understanding the article correctly it’s not that the glue is pre-printed with a specific code but rather the glue has a bunch of particles suspended in it and take on an arbitrary pattern when used. Conceptually similar to https://trmm.net/Glitter/ https://trmm.net/Glitter/ but at a much smaller scale.
- gcr 3y ago> "They also demonstrated a machine-learning model that helps detect tampering by identifying similar glue pattern fingerprints with more than 99 percent accuracy." This system would probably have to be far better than 99% to be helpful. If customers test (say) a hundred thousand tags per day, we might suppose that 99% accuracy means a thousand false alarms per day. If users get suspicious and return their genuine devices upon seeing a false alarm, that's a huge cost, even without any fakes at all. Reporting "99% accuracy" allows a worrisome amount of luck into a system marketed as "tamper-proof." Let's compare to biometric verification. Apple's TouchID claims about 1 false accept among 50,000 fake fingers (FAR=0.00002) with false rejection rates (FRR) hovering around 2%-10% or so. Even though this averages to worse than 99% "overall accuracy," it makes sense for a fingerprint matcher because the genuine user gets to retry their finger a few seconds later, so high FRR isn't a problem in practice. On the other hand, it may be better for these tags to trade off a higher FAR for a lower FRR. I'm also worried by the article's claim that terahertz waves "travel much faster than radio waves." The speed of light doesn't depend on its frequency.
- borispavlovic 3y agoI read 99% percent accuracy in a given time. For 1% the algorithm could ask the user for patience and perform a "deeper" search increasing its overall accuracy.
- pimterry 3y ago> This system would probably have to be far better than 99% to be helpful. This article does talk about this specifically: > “One drawback is that we had a limited data sample for this demonstration, but we could improve the neural network in the future if a large number of these tags were deployed in a supply chain, giving us a lot more data samples,” Lee says. I.e. they're well aware that 99% would need to be improved, but it sounds like they've managed to hit that level with a handful of individually created samples and a tiny project to train a model. This is just a prototype really, and 99% accuracy when testing a prototype doesn't seem unreasonable, it's not like they're planning to ship this tomorrow. It's a demonstration that recognizing these patterns automatically is actually possible in the first place, and in a serious roll-out scenario it would _probably_ be possible to train a model to do very significantly better.
- bagels 3y agoI can't help but think that this was funded by Nike so they can somehow sell plastic shoes for $10k.
- jorticka 3y agoThis is for cheap tags. Nike can afford a $1 crypto tag.
- fatkam 3y agohate those "foam" soles (not sure if that is considered plastic)... it's getting hard to find rubber soles
- dotancohen 3y agoThe Beatles had an album that might interest you. In fact, they pretty much stopped touring after that one.
- ngneer 3y agoSo, PUFs?
- nonrandomstring 3y agoTriplicate post? I've never seen this happen before. How odd [0]. [0] https://news.ycombinator.com/context?id=39431680 https://news.ycombinator.com/context?id=39431680
- vessenes 3y agoI got interested in this space a number of years ago, and have some investments in it; overall my takeaway is that supply chain integration is the main thing, not necessarily hardware innovation, at least so far. Sadly, this is unlikely to be deployed commercially. But it's cool to come up with new ideas in the space! A couple key points: * Readers work at a 4cm distance * Rather than a key database, the researchers propose an AI to memorize patterns These are no-go for almost all product ID scenarios I can imagine. Not least because the AI will have a harder and harder time validating patterns the more patterns are thrown at it. As described, a registry would be better, much better. But still bad. David Chaum has done some work using glitter patterns on banknote bills, which I think is super cool, essentially: random reflective pattern from glitter -> some sort of FFT / visual identification signature -> stored in a registry. Even that is going to be somewhat tough because you'll need the registry. Or alternately a chip that can store a signature and a reference to the pattern, in which case you'll just need a reader that knows the public key of the signer.
- YetAnotherNick 3y agoIs this AI like detecting QR is an AI task or AI could actually mislabel product some percentage of time?
- toss1 3y agoI recall the article mentioned they got to "99% reliability". As a manufacturer of high-end products looking for a good authentication solution, I was thinking this might be cool until I read that. Having errors in 1 in 100 identification passes is nowhere near usable. I'd want I'd down under one misidentification in 10k or 100k readings (fail/redo/succeed is ok in 1%). The entire point of the system is to be able to definitely determine that "this is a counterfeit" or "yes, we made this in batch K69342". If it can't do that reliably, why would I invest in building this into our manufacturing flow?
- YetAnotherNick 3y agoReading the content it seems like 99% is only for detection of physical tampering, i.e taking the chip out of real thing and putting it in fake thing, which significantly decreases the intent tamper as you need to destroy the real thing.
- rkagerer 3y agoSounds like ChipDNA (from Analog Devices if I recall) but with glue patterns instead of silicon.
- savrajsingh 3y agoDustidentity.com has been around for a while and is something similar -- but there is no “tag” - it’s invisible. Diamond nanoparticles!
- m3kw9 3y agoI don’t need to remove the glue, I remove the material underneath the glue given it’s soft enough, esp for clothing items
- pugworthy 3y agoCuriously, the act of unpeeling adhesive tape generates non-polarized Terahertz radiation - so the dying act in a sense for one of these being peeled off might be to have one final taste of Terahertz legitimacy of its own creation.
- Exoristos 3y agoWhy not just record a microscopic look at some specific quadrant of the items? It seems like there'd be at least as much entropy to exploit that way as with these metal fragments. I don't mean just a photo, but some way of describing a fairly stable quality of the material at a level of detail minute enough to ensure sufficient entropy.