5 ms·

Students need the lanyard to use the library or cafeteria, vote in school elections, I graduated from high school nearly 10 years ago, we had ID cards with mag

by iamdave 14y ago

Students need the lanyard to use the library or cafeteria, vote in school elections, I graduated from high school nearly 10 years ago, we had ID cards with magnetic stripes. I graduated from college with some additional voluntary coursework four years ago. We had cards with magnetic stripes and QR codes. Both worked in the function of identifying the student, and swiping in the mess hall as currency. Quantity wasn't a problem even with a student body count of nearly 5500 in a high school, our student numbers started with 0000 and were (iirc) 18 digits long. So here's my question: why was RFID aggressively pushed if tracking wasn't an explicit understated purpose, when there is tech perfectly capable of performing the duties outlined?

kennywinker 14y ago
I would guess most of the vendors of these types of systems are going RFID. Magnetic stripes are fragile, as anyone who's had their visa de-magnatized can tell you. They are also perceived as "less secure", as anyone who knows anyone who's had their visa card "skimmed" can tell you. For these reasons alone, RFID is where the puck is going to be. Then on top of that you add in you can sell institutions on tracking packages and analytics software and all that crap? I'm sure you can still buy mag-stripe versions of all this, but the people who do this are probably pushing RFID hard.
- iamdave 14y ago
  I would guess most of the vendors of these types of systems are going RFID Actually this makes sense, didn't think of that way. However, comparing security issues of credit/debit cards with student ID badges doesn't work; I'm not suggesting they don't exist, but on the whole are less likely in the setting we're looking at.
  - kennywinker 14y ago
    I was mostly thinking of the perception of security. Everyone knows you can clone a mag-stripe card cheaply and easily. I assume you can do the same with RFIDs (and you don't even need physical access to do it, right?) but I think people assume they're safer.
  - objclxt 14y ago
    You'd be surprised - when I was at college there was a student who was caught skimming ID cards, duplicating them, and selling them on (for access to various areas and also for payment, since our ID cards were used a declining balance cards). They switched over to RFID shortly afterwards. I'm sure this has happened at other colleges too. And whilst this sort of thing is almost certainly less common than card fraud, the potential consequences are actually far more serious. If someone skims your credit card it's inconvenient, but hopefully your bank will cover the loss. If someone skims your ID card in a college environment where ID cards typically let you into controlled areas like dormitories and labs you've got a big problem.
    - iamdave 14y ago
      You'd be surprised - when I was at college there was a student who was caught skimming ID cards, duplicating them But in a high school? Not that I'm disagreeing with you; but in high school the incentive seems to be much lower to forge ID cards. Maybe I'm just crotchety about this whole thing and am projecting to find whatever reason I can to dismiss the idea of forcing tracking on kids.
      - tass 14y ago
        RFID is the future. Magnetic cards were a problem waiting to be solved. They wear out, have to be big enough to comfortably swipe, and are easy to copy. Credit cards, door locks, train tickets and anything with a magnetic swipe or barcode will eventually be replaced with RFID or similar. The tracking part, however, is optional.
- cbhl 14y ago
  RFID chips are fragile in different ways (try holding three in front of a reader at once). When NFC enabled chip and pin cards first came out (and RFID enabled e-passports for that matter) came out, there were concerns that these cards could be skimmed from hundreds metres away as opposed to skimming requiring the card being placed in a modified payment terminal.
  - csense 14y ago
    > there were concerns that these cards could be skimmed from hundreds [of] metres away Why is that no longer a concern? I would certainly be concerned about it. Even if the cards can't be cloned from a distance, couldn't they still be tracked from a distance? Could the school actually be helping stalkers follow students unobtrusively?
    - TeMPOraL 14y ago
      It is, and the cards still can be cloned. You just need a big enough antenna. See: http://hackaday.com/2012/05/27/reading-rfid-cards-from-afar-easily/ http://hackaday.com/2012/05/27/reading-rfid-cards-from-afar-... + I recall someone else building a big antenna that allowed to read cards from range of meters.
      - Wingman4l7 14y ago
        Reminds me of the "bluesniper", which was basically a Yagi antenna on a rifle stock, meant for sniffing Bluetooth devices from a distance.
    - cbhl 14y ago
      It's debatable. Some steps have been taken to mitigate the impact (foil envelopes for your Passport Card, basic shielding on e-Passports, the introduction of MiFare DESFire as an alternative to MiFare Classic) but AFAICT it's still possible to skim the cards remotely. There was a period of time when these concerns were all over mainstream media (especially in Canada and Europe, during the migration to Chip-and-PIN, particularly for credit cards) but you don't see it often these days (except in extreme cases like the one in this article).
- knowaveragejoe 14y ago
  To be fair, skimming is and likely always will be an issue with RFID as well, unless there are low power microprocessors in the card that generate unique keys that are somehow syncronized with an external database...maybe someone with more experience can weigh in on this?
  - gizmo686 14y ago
    I would imagine existing cryptography could work. Each card could have a unique private key, and the public key would be associated with the students ID. At this point, someone can verify a card is who it says it is by asking the card to encrypt a randomly generated message. Assuming we are using the method I described (as apposed to a crypto-system optimized for identification), the card would only need to be able to encrypt 1 block (probably 512-bits) for each identification. This seems quite doable.
gnosis 14y ago
You don't even need cards with magnetic stripes or QR codes. These are relatively modern inventions. Schools did just fine without them for millenia. I went to school without either, and the school managed to serve their student body just fine. This obsession with tracking people's every movement and action, and the surveillance state built to satisfy it is really disturbing and pathological.
- clavalle 14y ago
  "Schools did just fine without them for millenia." Yeah, they did fine without grades stored in a database, too. This is simply a way to take attendance in a more efficient manner. Would you rather a teacher spend 5 minutes out of every class taking attendance or use a more efficient automated system. These things don't track every movement. They track whether people have walked through certain doors or not...
cbhl 14y ago
The obvious counterargument: When I was in primary school, we used paper and pencil cards to track items which were borrowed from the library. Why were barcodes and magnetic strips aggressively pushed when there was tech perfectly capable of performing the duties outlined? Part of me thinks forcing this on a child is insane. Part of me realizes that I already have agreed to monitoring of this sort in fragmented ways: HID RFID badges to get into my residence building at university and into buildings during work terms; NFC for payments and my transit fare card; Google location history on my phone.
- deleted 14y ago
  [deleted]
- iamdave 14y ago
  Why were barcodes and magnetic strips aggressively pushed when there was tech perfectly capable of performing the duties outlined? Good question, my immediate thought though-as a library assistant in school (because fuck yeah being a bookworm as a kid) is that the school library system was probably better served using this tech electronically; saves time, minimizes documentation errors, and as a result minimizes cost replacing books that went 'missing'.
chromaticorb 14y ago
I imagine its a third systems engineer maximising profits/suckered into buying it, a third RFID manufacturers aggressively trying to consume marketing share and a third the proportion of people in the world who are really creepy and should stop spying on people. Its unwieldy for most purposes in addition to the privacy concerns, but I'm reticent to go all Alex-Jones-fly-off-the-handle hysterical about this.
csense 14y ago
Corruption's always a possibility -- maybe the RFID provider is owned by a school board member's brother-in-law, or maybe they've paid off the right people. But we don't need to assume malice where mere incompetence will suffice. I can easily see technologically illiterate school officials being wow'ed by slick company salesmen. Since too few citizens really care about local politics, it also isn't a stretch to think that nobody who realized the implications attended the school board meetings where it was discussed and approved. By the time things get as far as they've gotten in this situation, the plan's supporters can't back away from the plan without losing money and face.
ConstantineXVI 14y ago
I graduated from a Catholic high school of 1200 ~7yr ago that in my last year actually used a similar RFID-tag system for the doors (was already using plain bar-codes for the cafeteria). AFAIK the (stated) purpose was access control; RFID makes a bit more technical sense simply to keep the doors from backing up or bar-codes getting muddied up (not that it kept the things from breaking continuously anyway). No one ever raised a fuss (not to say I personally agreed).

by iamdave 14y ago

kennywinker 14y ago

I would guess most of the vendors of these types of systems are going RFID. Magnetic stripes are fragile, as anyone who's had their visa de-magnatized can tell you. They are also perceived as "less secure", as anyone who knows anyone who's had their visa card "skimmed" can tell you. For these reasons alone, RFID is where the puck is going to be. Then on top of that you add in you can sell institutions on tracking packages and analytics software and all that crap? I'm sure you can still buy mag-stripe versions of all this, but the people who do this are probably pushing RFID hard.

iamdave 14y ago
I would guess most of the vendors of these types of systems are going RFID Actually this makes sense, didn't think of that way. However, comparing security issues of credit/debit cards with student ID badges doesn't work; I'm not suggesting they don't exist, but on the whole are less likely in the setting we're looking at.
- kennywinker 14y ago
  I was mostly thinking of the perception of security. Everyone knows you can clone a mag-stripe card cheaply and easily. I assume you can do the same with RFIDs (and you don't even need physical access to do it, right?) but I think people assume they're safer.
- objclxt 14y ago
  You'd be surprised - when I was at college there was a student who was caught skimming ID cards, duplicating them, and selling them on (for access to various areas and also for payment, since our ID cards were used a declining balance cards). They switched over to RFID shortly afterwards. I'm sure this has happened at other colleges too. And whilst this sort of thing is almost certainly less common than card fraud, the potential consequences are actually far more serious. If someone skims your credit card it's inconvenient, but hopefully your bank will cover the loss. If someone skims your ID card in a college environment where ID cards typically let you into controlled areas like dormitories and labs you've got a big problem.
  - iamdave 14y ago
    You'd be surprised - when I was at college there was a student who was caught skimming ID cards, duplicating them But in a high school? Not that I'm disagreeing with you; but in high school the incentive seems to be much lower to forge ID cards. Maybe I'm just crotchety about this whole thing and am projecting to find whatever reason I can to dismiss the idea of forcing tracking on kids.
    - tass 14y ago
      RFID is the future. Magnetic cards were a problem waiting to be solved. They wear out, have to be big enough to comfortably swipe, and are easy to copy. Credit cards, door locks, train tickets and anything with a magnetic swipe or barcode will eventually be replaced with RFID or similar. The tracking part, however, is optional.
cbhl 14y ago
RFID chips are fragile in different ways (try holding three in front of a reader at once). When NFC enabled chip and pin cards first came out (and RFID enabled e-passports for that matter) came out, there were concerns that these cards could be skimmed from hundreds metres away as opposed to skimming requiring the card being placed in a modified payment terminal.
- csense 14y ago
  > there were concerns that these cards could be skimmed from hundreds [of] metres away Why is that no longer a concern? I would certainly be concerned about it. Even if the cards can't be cloned from a distance, couldn't they still be tracked from a distance? Could the school actually be helping stalkers follow students unobtrusively?
  - TeMPOraL 14y ago
    It is, and the cards still can be cloned. You just need a big enough antenna. See: http://hackaday.com/2012/05/27/reading-rfid-cards-from-afar-easily/ http://hackaday.com/2012/05/27/reading-rfid-cards-from-afar-... + I recall someone else building a big antenna that allowed to read cards from range of meters.
    - Wingman4l7 14y ago
      Reminds me of the "bluesniper", which was basically a Yagi antenna on a rifle stock, meant for sniffing Bluetooth devices from a distance.
  - cbhl 14y ago
    It's debatable. Some steps have been taken to mitigate the impact (foil envelopes for your Passport Card, basic shielding on e-Passports, the introduction of MiFare DESFire as an alternative to MiFare Classic) but AFAICT it's still possible to skim the cards remotely. There was a period of time when these concerns were all over mainstream media (especially in Canada and Europe, during the migration to Chip-and-PIN, particularly for credit cards) but you don't see it often these days (except in extreme cases like the one in this article).
knowaveragejoe 14y ago
To be fair, skimming is and likely always will be an issue with RFID as well, unless there are low power microprocessors in the card that generate unique keys that are somehow syncronized with an external database...maybe someone with more experience can weigh in on this?
- gizmo686 14y ago
  I would imagine existing cryptography could work. Each card could have a unique private key, and the public key would be associated with the students ID. At this point, someone can verify a card is who it says it is by asking the card to encrypt a randomly generated message. Assuming we are using the method I described (as apposed to a crypto-system optimized for identification), the card would only need to be able to encrypt 1 block (probably 512-bits) for each identification. This seems quite doable.

gnosis 14y ago

You don't even need cards with magnetic stripes or QR codes. These are relatively modern inventions. Schools did just fine without them for millenia. I went to school without either, and the school managed to serve their student body just fine. This obsession with tracking people's every movement and action, and the surveillance state built to satisfy it is really disturbing and pathological.

clavalle 14y ago
"Schools did just fine without them for millenia." Yeah, they did fine without grades stored in a database, too. This is simply a way to take attendance in a more efficient manner. Would you rather a teacher spend 5 minutes out of every class taking attendance or use a more efficient automated system. These things don't track every movement. They track whether people have walked through certain doors or not...

cbhl 14y ago

The obvious counterargument: When I was in primary school, we used paper and pencil cards to track items which were borrowed from the library. Why were barcodes and magnetic strips aggressively pushed when there was tech perfectly capable of performing the duties outlined? Part of me thinks forcing this on a child is insane. Part of me realizes that I already have agreed to monitoring of this sort in fragmented ways: HID RFID badges to get into my residence building at university and into buildings during work terms; NFC for payments and my transit fare card; Google location history on my phone.

deleted 14y ago
[deleted]
iamdave 14y ago
Why were barcodes and magnetic strips aggressively pushed when there was tech perfectly capable of performing the duties outlined? Good question, my immediate thought though-as a library assistant in school (because fuck yeah being a bookworm as a kid) is that the school library system was probably better served using this tech electronically; saves time, minimizes documentation errors, and as a result minimizes cost replacing books that went 'missing'.

chromaticorb 14y ago

I imagine its a third systems engineer maximising profits/suckered into buying it, a third RFID manufacturers aggressively trying to consume marketing share and a third the proportion of people in the world who are really creepy and should stop spying on people. Its unwieldy for most purposes in addition to the privacy concerns, but I'm reticent to go all Alex-Jones-fly-off-the-handle hysterical about this.

csense 14y ago

Corruption's always a possibility -- maybe the RFID provider is owned by a school board member's brother-in-law, or maybe they've paid off the right people. But we don't need to assume malice where mere incompetence will suffice. I can easily see technologically illiterate school officials being wow'ed by slick company salesmen. Since too few citizens really care about local politics, it also isn't a stretch to think that nobody who realized the implications attended the school board meetings where it was discussed and approved. By the time things get as far as they've gotten in this situation, the plan's supporters can't back away from the plan without losing money and face.

ConstantineXVI 14y ago

I graduated from a Catholic high school of 1200 ~7yr ago that in my last year actually used a similar RFID-tag system for the doors (was already using plain bar-codes for the cafeteria). AFAIK the (stated) purpose was access control; RFID makes a bit more technical sense simply to keep the doors from backing up or bar-codes getting muddied up (not that it kept the things from breaking continuously anyway). No one ever raised a fuss (not to say I personally agreed).