Slashdot Mirror
RFID Kill Command Proposed To Ease Privacy Concerns
morcheeba writes "In the ongoing RFID benefits vs. privacy concerns saga, backlash has prompted manufacturers to include a password-protected "kill" command into new RFID protocols. Will this eliminate too many of the benefits for manufacturers?"
OK, they implement the "kill" feature. But - How can the customer know they RFID tag was in fact killed? They can just say they killed it, and the customer has to believe.
Make even shorter URLs - 8LN.org
Well its a start, we need more of thease stories these days
Slashdot - The one stop shop for procrastination
This doesn't work for me ... sorry, but RFID as-is is just potentially too invasive. It will be like wearing hardware cookies on your body or in your tires. I like cookies in my browser, but I still place some restrictions on them.
... and at that point I wouldn't mind them giving me targetted ads or coupons at the drive through based on my anonymous RFID in their database ... BUT ... I forget to grab cash and stumble upon a McD's that takes credit (I think they either do now in some places or are planning to) so I fork over my card. *BANG* they know my name and some of my habits (as well as locations I've been if I tend to stop at McD's on those long road trips). It doesn't matter if I pay for everything after this point with cash as long as I drive my car there.
The only viable option to preserve consumer privacy while enhancing retail usability would be legistlation that requires the RFID tag to be put on a removable label. Buy a shirt with an RFID tag? No worries, just tear off the removable tag. Put a recycling bin at the store exit or cash register and the company can even put the tags back into use (a well done RFID database should allow the store to deactivate an RFID upon purchase and reactivate upon recycling).
Worried about shoplifters removing the RFID tag before purchase? Too bad. A smart shoplifter will find a way around this system, too (heck, RFID tags may in theory make it -easier- to do the old price tag switching maneuver, too). To make it a bit nastier, make it illegal to remove the tag before purchase. Embedding the tag in an unremovable place is bound to be attractive to companies that want to be sure nothing walks out the door, but sorry, I'm willing to pay a bit more for merchandise and have my privacy secure.
Otherwise I'll wait until some bright folks invent a nice little RFID jammer before I buy from a store that has these implemented or a proven device that can fry RFIDs.
A jammer should not be that hard to do. It could sense when an RF signal was going out to read the tags and then respond back with tons of nonsense tags (like the 802.11b project that broadcasts thousands of fake SSIDs). Or it could sense when your RFID tag was -responding- and send stuff out then. You could make it illegal to use the scanner in a retail chain, but once out the door turn it on so that your car's tires can't be scanned at McDonald's.
A truly intelligent scanner could be made that figured out your RFID signatures, uploaded them to other people with a jamming device, then you can help foil the inevitable scanners by carrying around random RFIDs of other people in the system.
Seriously, if people could read the bar tags off whatever box you were carrying around, even when it was in a bag, do you think people wouldn't carry big fat black magic markers around to disable the bar codes after purchase (or simply rebel against the concept of bar codes)?
I seriously don't want to have to expand my concept of a "personal firewall" to this level. Privacy has been nearly destroyed as-is, but at least I can still buy a shirt, tires, etc with cash and not have it logged with my name. But RFID enables complete tracking of individuals who carry the tags around. A quick example for closing (since I'm sure someone is going to say this is bogus):
* I buy tires for my Jeep that have embedded RFID tags so that the local tire shop can easily track their inventory.
* I drive to McDonald's for a burger with those tags installed.
* McDonald's doesn't know what the RFID was for originally, but they really don't care, they can just assign the RFID to me.
* McDonald's doesn't know who I am though
* Every store owned by McDonald's (did you know they own Chipotle for instance?) now knows about me. Better yet, some genious can now decide to sell my information to other marketing organizations.
* Add to this an RFID in your cellphone, you carry that everywhere, and the
It is more productive to voice thoughtful opinions (reply) than to judge (moderate) others.
The kill command is password-protected.
Make even shorter URLs - 8LN.org
How do we know that this 'kill' command kills the RFID tag and not...say... the user ?! Next thing you know, they'll be putting these things in your teeth! And when I say "they" I mean the Martians...right after the anal probe.
No, I will not take off my tin foil hat....
This rush to a totally surveilled, cashless society, bugged, videoed, tracked, data mined, rush to the new world order big brother stuff is just plain disgusting. I think if we can't stop it now it will make a borg-like society look like a libertarian convention in the woods.
Some technology is good, other technology can be *not so good*. You give big brother unlimited funds, the ability to semi collapse economies so they can get all the techs they need lining up for "work", paying off the research universities, and the judge dredd "I am DE LAWWW!" mindset, that's just asking for it.
And sensor nets?? Nanotech cameras that can be so small you can't hardly find them? Mega terrabyte storage and smart AI? And people want THIS government to have all that stuff??? Microwave beam weapons, sonic nausea generators? Big bro having the ability to enter a few commands and your entire credit, medical, education, police record, whatever "history" can be altered or deleted? Little one meter across hover drones with cameras and weapons mounted in them? DNA databases? Biometric microchips with radios in them? Huh? Huh? Say WHUT? And this is supposed to be COOL?
Nuts. It ain't paranoia when you can read about it and verify it. These are legit concerns that are not being addressed, government is just DOING it and there's no stopping them now, too many will take the blood money it appears. Enough was enough like 10 years ago. I can remember getting razzed seriously then when I told people it weas coming, they said "naww, never happen". Well here it is, in your face, real. Now we got hacked closed source "official voting", so that option has poofed.
Double phooie.
Opponents of RFID tagging say the tags make it theoretically possible to "profile" a consumer remotely... But that scenario is unlikely "unless you live in a totalitarian state with a perfect information architecture"
Umm, does this cover countries other than the US? I don't know about perfect, but it's definitely totalitarian.
Yes, I am an agent of Satan, but my duties are largely ceremonial.
Passive low frequency RFID's which are generally what people are 'scared' of are just little reflectors for radio frequency. They emit their serial number. Whoopty doo. The cheapest ones, which we are likely to see used in retail situations transmit on 30Khz to 500Khz.
What's to stop someone from bringing a jammer into the store? Or broadcasting fake ID numbers at the antenna? The possibilities of destroying the credibility of collected data by jamming legitimate traffic or spamming with bogus traffic seem to be fairly obvious?
The great thing is, because each manufacturer will have it's own numbering scheme, the IDs probably won't even be encrypted.
http://www.remix.net/
This is one of those fundamental dilemmas. RFIDs or privacy: pick one.
The winner of this will be decided by power. Whoever has more power will win. Privacy advocates versus the money men. Don't bet against money. The problem that RFIDs are (poorly) designed to solve is shoplifting. Privacy advocates should figure out a better way to reduce shoplifting, and then argue their case by saying that that is better than RFIDs.
The obvious alternative to RFIDs is, of course, e-commerce. In e-commerce, there is no shoplifting. One could argue that "RFIDs are basically a pathetic attempt by dinosaur retailing to keep their obsolete business model alive."
Another alternative way to reduce shoplifting is to issue a store identity card. You could still enter a store and look at all the things they have for sale. Display items would still be out in the open. But to get to the inventory, you'd have to swipe your store identity card, which would allow you to pop open a little clear plastic door. Then, you take out the shirt or can of soup that you want. A sensor like that in hotel minibars determines whether you take anything from the cubby hole, and if so, how much. Then you go pay for what you took out. When you pay, you flash your store ID card. If you don't pay for it or put it in the "return bin" again swiping your card, the cops will hunt you down. The privacy concerns with this plan are the same as for e-commerce.
Store ID cards would still work for small retail outlets, even those with one store. Instead of having their own unique store ID card, they would join a clearinghouse system. This would be analogous to Visa or Mastercard, but would be different. (Identiy kept separate from funds.) Once a consumer got a clearinghouse card, they could shop at one of, let's say, thousands of participating stores.
E-commerce is cheaper than RFIDs, and not just because of all the negative PR from RFIDs that stores will avoid. The store ID card idea is also cheaper than RFIDs. Both e-commerce and the store ID card idea would significantly reduce shoplifting.
Oh, they're going to use an uncrackable password protection system? Like one time pad? Don't make me laugh. There's no way to keep the secret keys secret.
Oh, they're going to use one generic password for entire product lines, or entire stores? Let's see. How hard would it be to manufacture a small handheld device that brute force checks every possible password and broadcasts a kill command for each within a few seconds' time? Oh, would that be too difficult? Okay. Shoplifters go down to the store, buy a box of cereal flakes legitimately, then take the box out to their car, where they then brute force the RFID for the whole product line or the whole store. They program their handheld RFID killer appropriately. Then they reenter the store and take whatever they want.
How are consumers supposed to get the password? If the consumer can't get the password, the kill feature is useless. If the consumer can get the password, so can shoplifters.
This is the same basic encryption problem that Schneier talks about in Secrets and Lies. Security is hard. There's no magic bullet that will keep you safe in the world. There's always risk.
From what I understand RFID's run on the power they recieve from the transmitter. What if you use a microwave or other kilowatt transmitter to power the RFID? I think that if a microwave can make a fork arc it should make short work of an RFID.
...under one condition. Namely, that anyone selling merchandise with RFID tags is required by law to physically remove those tags at the time of purchase. As a corollary, any manufacturer which puts RFID tags into merchandise would be required to do so in such a way that this could be done.
All the benefits of RFID, but minus the privacy concerns, since any legitimately-purchased merchandise would be de-tagged before it left the store.
"since any legitimately-purchased merchandise would be de-tagged before it left the store. "
Mistakes happen, little magnetic tags currently used occasionally get left in things. Last time I purchased a wallet for example, the clerk flipped it open looked through it, and didn't find a little magnetic tag in it. Took me a few months to figure out why I was beeping intermittenly at the scanners everywhere. Thats not likely to happen too often, or be a major concern though, it's not institutionalized tracking tags after all.
If the RFID is used for inventory management, then a killable (or removable) RFID is entirely sufficient for industry needs, and limits the privacy threat dramatically.
(If it's intended to prevent shoplifting, or for various after-purchase marketing purposes, then any RFID that can be reliably killed or removed is obviously not sufficient for industry needs.)
Personally, I won't mind RFID tags if they can be reliably killed. Or at least, I don't think it's a big privacy issue...
It exacerbates some economic issues, though. The benefits of RFID inventory control would mostly come from reduced overhead (read: employment) at the stores that could afford to deploy it. Sadly, RFID is more likely to be deployed at Wal-Mart than at Joe's Hardware. Wide deployment of RFID will probably put local retailers in an even worse competitive position than they have now.
With reasonable men I will reason; with humane men I will plead; but to tyrants I will give no quarter. -- William Lloyd
Ow! My pacemaker!
The potential for abuse here is enormous. Do you think that the alphabet agencys not just of the US but of the entire world will fail to take advantage of this WASS (we are soo screwed)
Diplomacy is the art of saying "Nice doggie" until you can find a rock. Will Rogers