›
This forum is in permanent archive mode. Our new active community can be found here.

GeekNights 080421 - RFID Security and Privacy

RymRym
edited April 2008 in Technology
Tonight on GeekNights, we consider security and privacy in an RFID world. In the news, ABC fails to hold back the tide of timely commentary, and the Patent Office may well have noticed the issues with recent patents.

Scott's Thing - ACT I, SCENE 2
Rym's Thing - Never give up

Comments

  • ZakoSoldierZakoSoldier
    edited April 2008
    answered in Episode.
    Post edited by ZakoSoldier on
  • TyashkiTyashki
    "He doesn't have to whip it out cause its so powerful."

    lol
  • BronzdragonBronzdragon
    The supermarket I work at has cards which you can get anonymously. If you choose to give your personal info you can get extra offers sent in the mail.
  • NeitoNeito
    Is there any risk of RFID spoofing? Like, if you can grab someone's card while they're not looking, could you make a copy?
  • AprecheApreche
    Is there any risk of RFID spoofing? Like, if you can grab someone's card while they're not looking, could you make a copy?
    Easily. If you can read someone's card, you can copy it. Of course, that doesn't necessarily mean you know where to use it. If I sit in the park and scan RFIDs, the only useful things I will grab are probably credit cards. Everything else will just be numbers. I can make cards with the same numbers, but how will I know if they are articles of clothing or keys to doors? If I know they are keys, how do I know which doors they open?

    Since the non-credit card RFIDs have no useful information in them, they are useless without the database. Also, even if I have the number and the database, how do I know that RFID isn't actually meant to be used with a different database than the one I have? What if someone's front door happens to use the same number as a UPC for underwear?

    If you get credit cards, you can go out and start buying things in places that have the RFID credit card scanners, or maybe on the web. However, you will be easily caught by the existing fraud protection mechanisms.
  • RymRym
    Is there any risk of RFID spoofing? Like, if you can grab someone's card while they're not looking, could you make a copy?
    If you grab someone's credit card, it's just as easy to spoof the magnetic strip data.
  • AprecheApreche
    Is there any risk of RFID spoofing? Like, if you can grab someone's card while they're not looking, could you make a copy?
    If you grab someone's credit card, it's just as easy to spoof the magnetic strip data.
    It's just as easy for the waiter in a restaurant to look at your credit card and write down the numbers with a pen and paper.
  • KieyKiey
    While listening to you talk about the patent problem I basically came up with a similar system as to what Rym was proposing. Where there is a period where you are granted a patent but must produce the invention within a number of years, then your patent is extended for a few more years allowing you to have a monopoly while selling it.

    I think though that the initial phase of the patent from the design patent to the production of the invention needs to be more then 2 years, maybe 3 years at least. This is because a company who might produce it for you, or want to buy the patent outright might wait out the patent if the time is too short. Which would force inventors to possible sell their patents for less then they are worth, or possibly lose them before they were able to do something with them. So there needs to be a balance where the inventor isn't given too much time where they could just sit on it and do nothing, and not enough time where it is detrimental to the patent holder.

    Also it took me about half through the first scene of Scott's thing of the day, but it was epic.
  • BronzdragonBronzdragon
    Also it took me about half through the first scene of Scott's thing of the day, but it was epic.
    I didn't get it at all, but we didn't get Shakespeare at school (it's Shakespeare, right?). We had other things to do at English class. That doesn't mean we didn't have any literature, it means we had dutch literature.
  • RochelleRochelle
    Also it took me about half through the first scene of Scott's thing of the day, but it was epic.
    Yeah, it was pretty badass. I would love to see that acted out, if only by the original actors. That would truly be epic.

    @Bronzdragon

    Do you know where it's from?
  • DkongDkong
    edited April 2008
    Fail for the cat thing of the day. It wasn't funny. You guys are usually pretty jaded and cynical about web content, so I'm curious as to how this was thing of the day material... You guys are always talking about what good content you have for ToTD, and you usually do have good content.
    What gives?
    Post edited by Dkong on
  • BronzdragonBronzdragon
    Do you know where it's from?
    Nope. I did laugh at the acting, however.
  • RochelleRochelle
    Do you know where it's from?
    Nope. I did laugh at the acting, however.
    I can't access the livejournal page, however I'm 99.9% sure it's Pulp Fiction done by Shakespeare.
  • NeitoNeito
    I can't access the livejournal page, however I'm 99.9% sure it's Pulp Fiction done by Shakespeare.
    It's the quarter-pounder scene and the "English, motherfucker" scene.
  • ......
    I can't access the livejournal page, however I'm 99.9% sure it's Pulp Fiction done by Shakespeare.
    It is. I didn't know when I heard the hear play done by Scrym. Great job guys. As for the cat, it's cuuuuuute. One big black spot on it's left eye, such an adorable thing.
  • Victor FrostVictor Frost
    If there is ever a full script of Pulp Fiction Shakespereized, I will save it as a txt, then "encourage" the drama teacher to use it for my childrens highschool play.

    This is assuming I eventually have children.
  • spotdartspotdart
    edited April 2008
    Easily. If you can read someone's card, you can copy it.
    Having listened to the show, suppose I sat outside Rym's place of employment with an RFID "net." I pick up a single person's RFID, then wait till they go out for lunch (or leave for the day, or whatever) and at that point I'm in the building. The only way this is alright is if your inter-building security measures assume anybody can come in or out of the building. if your security measures make that assumption, then the RFID nonsense at the front door is a waste of time. If your security measures are fallible, then they might as well not exist.

    If all your access controls are RFID reliant, then stealing someone's identity is as easy as bumping into them on the street. If I copy all your RFIDs then as far as any RFID system is concerned, I'm you!

    Sorry to be the RFID troll, but I feel like people are posing straw man arguments.
    Post edited by spotdart on
  • FunfetusFunfetus
    When Rym mentioned his work RFID number, it seemed really short to me. I would've expected 64 bits or something. Such a short number leaves a lot more room for coincidences. Is that not really an issue? How long do these numbers tend to be for RFID in general?
  • LusankyaLusankya
    When Rym mentioned his work RFID number, it seemed really short to me. I would've expected 64 bits or something. Such a short number leaves a lot more room for coincidences. Is that not really an issue? How long do these numbers tend to be for RFID in general?
    When I was working in IT for a large telco that implements RFID at all entrances, elevators and even at terminals, I occasionally had to deal with bad keys in the security database. Our cards transmitted 256 bit keycodes, and your keycode was completely unrelated to any other identification number you had (largely because the manufacturer was fairly inflexible - you can't get bulk orders of unique RFID tags very easily). It's insanely overkill for our application, but at least it allows for growth.

    I know that you can go a LOT higher than that though - all the local Chapters use paper-thin RFID tags for shoplift security. Each tag in each book must be unique - if you buy a book and throw its tag through the sensor, the alarm stays silent. Throw a tag from a different copy of the same book, and the alarm rings.
  • GunfireGunfire
    edited April 2008
    Only passive RFID chips are without batteries. Semi-passive RFID tags use batteries to power it's internal circuitry, and the RF to power the transmission. Active RFID chips can use batteries to power both internal circuitry and transmission.

    Also, say with Serialized Global Trade Item Number (SGTIN) coding scheme of Electric Product Code RFID tags, the tags are serialized so that if Rym's tags are positively identified at one point they can be verified with some certainty at another point. Although, I have to agree that if you are in that situation you have much larger problems.
    Everything else will just be numbers. I can make cards with the same numbers, but how will I know if they are articles of clothing or keys to doors?
    Standardized coding schemes. With regards to credit card security, if it's a mag strip you can make sure that it's swiped in front of you. Unless the cashier has a super-duper memory, he/she probably won't remember your number. Credit cards would probably be some kind of semi-passive RFID. Although, if the protocol was broken, a cashier could theoretically have a little device secretly placed that would record the entire transaction. Also I understand that someone could do the same thing with magstripe readers, but it would probably take a bit more ingenuity, and would be specific to the reader.

    My school has a semi-passive RFID payment system. It involves some sort of encryption that I never bothered to investigate.

    I wouldn't say I'm paranoid of RFID. It's more general wariness before widespread adoption. I also agree that there are some mad cool things you can do with it.

    RFID Blocking Wallet and Passport Billfold

    EDIT: Apparently, I'm wrong. Wired says that American Express is using fully passive RFID with some encryption.
    Post edited by Gunfire on
  • RymRym
    When Rym mentioned his work RFID number, it seemed really short to me.
    You do realize that I made a number up, right? That I didn't actually say a real RFID number? 24601 is a fairly famous number...
  • ......
    When Rym mentioned his work RFID number, it seemed really short to me.
    You do realize that I made a number up, right? That I didn't actually say a real RFID number? 24601 is a fairly famous number...
    Ah, from Les Miserables it seems. Should read that book sometime...
  • FunfetusFunfetus
    You do realize that I made a number up, right? That I didn't actually say a real RFID number? 24601 is a fairly famous number...
    I figured it was made up, but that it was representative of what the number might be. Which, like I said, seemed short. I didn't recognize that number from anything, though. I guess I'm not up on that stuff.
  • StarfoxStarfox
    Ah, from Les Miserables it seems. Should read that book sometime...
    Or see the musical.
  • BronzdragonBronzdragon
    24601

    Popular myth states 24601, Valjean's convict number, was chosen by Hugo because it was the date that he was conceived (24th of June, 1801). It is only known that he was born on Feb 26, 1802, approximately 8 months later. Many characters in contemporary culture have the prisoner number 24601 as a homage to the original novel, most notably Sideshow Bob and Seymour Skinner from The Simpsons, Eric Cartman from South Park, Oscar Bluth from Arrested Development, Hank Jennings from "Twin Peaks", the player character from the computer game System Shock, and even Ms. Frizzle from The Magic School Bus. Strangely enough, this number is known much better than Valjean's second prison number, 9430 (most likely chosen because of the death of Hugo's daughter in september 1843), even though the second number is mentioned four times in the book, the first only twice. Presumably this is due to the fact that the second number is never mentioned in the popular musical, while the first is mentioned several times. In fact, Javert only refers to Valjean by that number.
  • ......
    edited April 2008
    Ah, from Les Miserables it seems. Should read that book sometime...
    Or see the musical.
    That is possible. I saw an add at the train station for it on Monday. Then again, a book is a lot longer and is the original story.
    Post edited by ... on
  • StarfoxStarfox
    You should see the play because it is one of the best musicals period, regardless of any book it may or may not have been based on.
Sign In or Register to comment.