5 ms·

So, maybe it's just me, but I don't see why RFID is such a great thing for secure applications. Like, it's an awesome technology for a retail store to do inven

by mdasen 17y ago

So, maybe it's just me, but I don't see why RFID is such a great thing for secure applications. Like, it's an awesome technology for a retail store to do inventory with. I mean, they can just pass a scanner near a bunch of products and figure out what they've got. Heck, each individual product can give a different ID which is even better than the simple barcodes that we use today. However, why would one use RFID when you don't want the reading to be easy? There are plenty of technologies that require physical contact to transmit information (like mag strips or smart chips). If they want the passports to have to be inserted into a machine, they might as well use one of those technologies. I'm all for RFID in its place. It's great for my subway pass so that I don't have to take it out of my wallet. Same for highway tolls where I don't have to stop. But neither of those are instances where I completely care about security. Sure, I don't want anyone cloning my subway pass, but it also isn't a window into my identity like my passport is and so I can choose convenience a bit over security there. Oh, a good example would be something like site passwords. Sure, I don't want anyone getting into my HN account, but it's not quite the same as someone getting into my bank account and, as such, I don't need quite as complex a password for it. I'm not saying that I like the idea of chips in passports, but if you're going to put one in, why RFID? Why on earth didn't they choose something that requires physical contact to be read? I mean, the article focuses on the RFID problems (that it can be read without you knowing it since it doesn't require physical contact) and doesn't explain how on earth RFID became the choice. While one might not want to have a chip on their passport, at least a chip that needed physical access to read would put the holder (mostly^) in control of who got access to that information. ^I say mostly because there are always pick pockets and such that could swipe it without your knowledge, but that's a much lower risk than someone walking around with an RFID skimmer - it requires the person to physically remove it from your person, put it in a reader, and return it to you without you or anyone else noticing; not impossible, but a great deal less trivial.

eru 17y ago
RFID is not even that much of a hit in retail, either. Some say, "yet". But widespread use of RFID in retail was "just around the corner" for several years, now. As long as the technology is not cheap enough to (profitably!) slap an RFID chip on every 25 cent cup of yoghurt, it won't be ready for retail. (At least that's the picture in Germany. But thanks to Aldi, Lidl and a few others --- most of our groceries don't even accept credit cards, because their razor-thin margins make them unable to swallow the fee. Debit card processing --- which is mostly free for the shop --- is nearly universal however. (Except for Restaurants; most accept only cash.))
- seldo 17y ago
  Wow, Germany sounds like a horrible place to go shopping.
  - dhoe 17y ago
    Careful with the quick judgments. Credit cards are not popular in many parts of Europe, so it's no big deal. I don't have one, for example, despite being in the top 10% income bracket in my country.
    - philwelch 17y ago
      In America, our debit cards are rigged so they work just like credit cards. This gives you some extra protections, delays when they draw from your bank account, (theoretically) gives you the protections of the merchant's agreement, and for many banks you get some sort of cash-back benefit from it. You can also pay with PIN if you want. That makes it post to your bank account quicker, which is nice if you keep track of your online banking.
      - nazgulnarsil 17y ago
        debit cards have less protection than credit, not more. I'd suggest looking at your contract with the bank and seeing where you are responsible for charges to your card.
        philwelch 17y ago
        I'm not sure what you're saying or how it's relevant. I'm comparing separate ways to use an American debit card. I'm not comparing either use case with using an actual credit card (which I concede has even more protections).
        nazgulnarsil 17y ago
        ah
philfreo 17y ago
Good to know that in the U.S. at least, if the passport is closed, the RFID is shielded. Anyone know of a successful attack against a closed US Passport?
- eru 17y ago
  According to the article - as far as I remember - closed only means, that you need to closer to the passport. > The official range of an e-passport’s RFID is supposed to be no more than ten centimetres (four inches). But with $100 worth of hobbyist gear, Israeli researchers managed to skim encrypted data off e-passports from several feet away. A student at Cambridge University in Britain went further, intercepting e-passport transmissions some 50 metres (160 feet) away. > That was enough for State Department officials in Washington, DC, to insist that American e-passports be fitted with metal sleeves to shield them, when closed, from prying electronic eyes. The measures seem to be reasonably effective, though e-passports that get wedged open slightly by keys or loose change can still be read electronically from a distance. > Slightly open passports could leave holders vulnerable to physical attack. Each country encrypts data in a characteristic way that terrorists could use to identify the nationality of the person carrying the chipped passport. To demonstrate the point, a firm called Flexilis used a partially opened American e-passport tucked in the pocket of a dummy to trigger an explosion as it passed a dustbin containing a small charge.

by mdasen 17y ago

eru 17y ago

RFID is not even that much of a hit in retail, either. Some say, "yet". But widespread use of RFID in retail was "just around the corner" for several years, now. As long as the technology is not cheap enough to (profitably!) slap an RFID chip on every 25 cent cup of yoghurt, it won't be ready for retail. (At least that's the picture in Germany. But thanks to Aldi, Lidl and a few others --- most of our groceries don't even accept credit cards, because their razor-thin margins make them unable to swallow the fee. Debit card processing --- which is mostly free for the shop --- is nearly universal however. (Except for Restaurants; most accept only cash.))

seldo 17y ago
Wow, Germany sounds like a horrible place to go shopping.
- dhoe 17y ago
  Careful with the quick judgments. Credit cards are not popular in many parts of Europe, so it's no big deal. I don't have one, for example, despite being in the top 10% income bracket in my country.
  - philwelch 17y ago
    In America, our debit cards are rigged so they work just like credit cards. This gives you some extra protections, delays when they draw from your bank account, (theoretically) gives you the protections of the merchant's agreement, and for many banks you get some sort of cash-back benefit from it. You can also pay with PIN if you want. That makes it post to your bank account quicker, which is nice if you keep track of your online banking.
    - nazgulnarsil 17y ago
      debit cards have less protection than credit, not more. I'd suggest looking at your contract with the bank and seeing where you are responsible for charges to your card.
      - philwelch 17y ago
        I'm not sure what you're saying or how it's relevant. I'm comparing separate ways to use an American debit card. I'm not comparing either use case with using an actual credit card (which I concede has even more protections).
        nazgulnarsil 17y ago
        ah

philfreo 17y ago

Good to know that in the U.S. at least, if the passport is closed, the RFID is shielded. Anyone know of a successful attack against a closed US Passport?

eru 17y ago
According to the article - as far as I remember - closed only means, that you need to closer to the passport. > The official range of an e-passport’s RFID is supposed to be no more than ten centimetres (four inches). But with $100 worth of hobbyist gear, Israeli researchers managed to skim encrypted data off e-passports from several feet away. A student at Cambridge University in Britain went further, intercepting e-passport transmissions some 50 metres (160 feet) away. > That was enough for State Department officials in Washington, DC, to insist that American e-passports be fitted with metal sleeves to shield them, when closed, from prying electronic eyes. The measures seem to be reasonably effective, though e-passports that get wedged open slightly by keys or loose change can still be read electronically from a distance. > Slightly open passports could leave holders vulnerable to physical attack. Each country encrypts data in a characteristic way that terrorists could use to identify the nationality of the person carrying the chipped passport. To demonstrate the point, a firm called Flexilis used a partially opened American e-passport tucked in the pocket of a dummy to trigger an explosion as it passed a dustbin containing a small charge.