Excellent podcast on privacy risks of RFIDs

This week on the Canadian Broadcasting Corporation's excellent Search Engine podcast, host Jesse Brown has posted part one of a fantastic interview with Ann Cavoukian about the risks associated with RFID-enabled identity cards and other personal objects and devices.

Jesse frames the issue as well as I've heard it ever framed: "They freak me out. Not because I think there's some kind of sinister government conspiracy behind them, but because the idea of every dude walking around with a thirty foot cloud of data emanating from his pants is so tantalizing that it invites sinister conspiracies. It challenges criminals' brains to come up with ways to defraud us. It woos law enforcement to blur or bend or rewrite the rules. That is how filled with FAIL arphid tags are."

Podcast #24 is up!

MP3 Link

Subscribe to Search Engine podcast feed

[#1 posted by Marcel, March 10, 2009 5:21 AM]

The thing that scares me, here in the Netherlands, is this blatant denial of our government concerning the inherent flaws of the system, and the subsequent push to introduce it into society with non-arguments that basically come down to; we're too far into the process to turn back now.
When one of the technological research teams of one of the most prestigeous universities in your own country proves that these tags can be easily cracked, cloned and then used repeatedly without being detected over the course of days, and you still deny there's a security issue, one seriously begins to wonder whether being a total moron is a job requirement for our government officials.

[#2 posted by Robbo, March 10, 2009 6:05 AM]

The "data cloud from the pants" thing is a great image. I always wondered what the world would be like if flatulence was visible. Not the same thing, I realize ... just sayin'.

[#3 posted by Nur, March 10, 2009 6:35 AM]

That's a godforsaken mispronunciation of R. F. I. D.

Is it a bird, is it a plane? No, and it's not an acronym either. It's just four letters, honestly.

I'm trying and failing NOT to make a pirate joke about "ARR-FID" chips.

And if you point him at a political figure then SUDDENLY his crazy pronunciation disappears. One rule (of linguistics) for the rulers and one rule for the ruled?

I like the comment: "We have people developing on-off switches for RFID chips". Does tin foil not work anymore? I may have to buy a new hat ;)

[#4 posted by zuzu, March 10, 2009 7:17 AM]

Previously in mispronouncing initialisms as acronyms:
* Some jerk saying "oh-lead" instead of OLED

[#5 posted by t3knomanser, March 10, 2009 7:22 AM]

I have to be honest though, I want a 30 foot data cloud emanating from my pants. I want it to be secure too, but honestly- having the features now and security later is, for me, an acceptable tradeoff. Just don't tie any RFIDs to anything important, like credit cards or passports. DOH!

A long time ago, I saw a patent application for an RFID firewall. My understanding of its function was that you would scan all your RFID tags with it, and it would store their authentication codes. When you wanted to provide your, say, credit card to an RFID scanner, you would instead provide the firewall device. It would capture the signal from the scanner, prompt you for an action, and if you okay it, transmit the stored RFID data for your credit card.

A good start, anyway. Of course, if they became common, a DDOS attack would be trivial. Shut down a POS terminal.

In any case, if I had my way, every object in the world would carry an RFID and have a URI.

[#6 posted by Nur, March 10, 2009 7:33 AM]

#4:

Exactly, I instinctively echoed your comment on the Oh El Ee Dee page. Sounds like he might own a lead torch. I read that the best computing people think in a consistent way? That's exactly the kind of people who should see OLED and think "well, it looks like LED but it's got an O at the start so I'll say it like this..."

I reckon many people should just be shown the weird acronym SCSI and asked to pronounce it. Sometimes you just have to grit your teeth and say it like all the other people.

[#7 posted by Riu, March 10, 2009 7:55 AM]

If you're afraid of 'pants leakage' hopefully one of these will be out for you by then:
http://www.boingboing.net/2007/11/06/rfid-guardian-open-h.html

[#8 posted by speculator, March 10, 2009 8:20 AM]

Here in Ontario I'm more concerned about abuse of this information by homegrown police than by American border guards. It seems to me that amidst massive layoffs and a failing economy, there is increasing incentive for people to embellish their income by means that aren't necessarily "legal" (ie. pirating dvd's) - crimes that are relatively less harmful to society than, say, gun violence, committed by people that are less sophisticated at committing crimes than, say, gang members. And yet we have real, dangerous criminals that continue to beat the system (like those guys in TO that recently got their case thrown out of court because video evidence against them was ruled inadmissable). At what point does this constant surveillance against "easier" targets (re: Merrimo of The Wire) take away resources from enforcing against "real" criminals? The ability to track anybody's movements is perhaps not making our cities better, and is possibly making them worse.

[#9 posted by jonathan_v, March 10, 2009 8:46 AM]

What always really concerns me is how people keep motivating themselves against RFID based on Science-Fiction , and totally disregard Science-Fact.

The large majority of panic cases and fear mongering against RFID -- and that is EXACTLY what this is -- defy the the laws of physics. They're simply impossible. This is the same type of bullshit nonsense exaggeration that tried to equate "September 11th", "Fear", and "Muslims".

When I worked in RFID years ago, there was a group of 'activists' starting to protest RFID tags. They went on endless , mindless, tirades based on fiction - trying to get people to go along with them. Eventually they got enough buzz that their leader started getting speaking engagements and into a graduate program of her choice. Maybe I'll be a conspiracy theorist and say that was their plan all along...

RFID is shit , buggy , bad technology. Its not very secure, but it doesn't work very well either. Add to that an awful 'range' unless you power the tags actively... and competition in the industry means many 'standards' and different antennae types needed to read them.

You'd be lucky if most tags could do a 30 inch cloud of data , as most start to crap out before 12.

[#10 posted by endospores, March 10, 2009 9:11 AM]

Oh come on don't be such babies. Just put your driver's license and/or passports in a layer or two of aluminium foil in your wallet and presto, no more rfid signals to be scanned.

[#11 posted by Flying_Monkey, March 10, 2009 9:15 AM]

There is certainly an awful lot of flatulence around RFID (and does it really matter how you pronounce this? aren't there better things to worry about?), and especially around their still very limited use in human subdermal implants. A lot of this has to do with the networking of biblical prophecy-based views of them amongst Christian groups who regard them as a mark of the beast (like they did barcodes before...). This hardly leads to informed critique though it does lead to noisy protest. Crap technology, yes? Sign of the end times? Get real...

[#12 posted by arkady, March 10, 2009 1:19 PM]

seriously isn't the primary purpose of rfid inventory control I mean sure you can know the brand of my jeans if you sneak up on my ass with your rfid scanner, but couldn't you do that by looking at them, really I think the upside is bigger then the downside here, because we need better inventory control in this world if we are going to try and not bury the planet under our refuse in our lifetimes. I think Bruce sterling does a fine job talking about the upside of rfid you should google it.

[#13 posted by Korgoths, March 10, 2009 1:38 PM]

Boy the tin foil hat crowd will love this story but the fact remains that RFID can be secured. I worked on the Smart Shelf project for a certain company and we not only had a working solution for retail stores but also one for Pharmacies and our tags weer secure.

All the tag held was a unique ID and nothing more, so even if you did scan the tag and got the ID it meant absolutely nothing unless you were able to hack the database but if you could hack the database you really didn't need the tag ID in the first place.

And non-powered RFID tags can only be read in about 24 to 30 inches, if you wanted to read tags from further away you would need to up the wattage on your reader so unless you wanted to carry around a portable generator so you could power your reader.

Now that being said some solutions are insecure because they try to place the data directly on the RFID tag without requiring a database or the need to verify that the data matches what is in the database. Case in point would be a Passport using a RFID tag that doesn't require the Customs agent to scan the passport and have it pull up a photo on file of the passport holder or other information only the real passport holder would know... but that is what the US Customs has in place for all RFID tagged US Passport.