Slashdot Mirror
RFID Explained
SecurityFocus has a nice column summarizing the last year's worth of stories about RFID. Of course, you, diligent Slashdot reader, have read about many of these already. But for your slacker friends that need an RFID education in one easy-to-digest article, here you go.
Isn't Wal-Mart adopting it?
Yes...this always comes up anytime some story regarding chips underneath skin. But it doesn't sound too difficult to slip a RFID tag underneath a hand or forehead.
Sounds an awful lot like this.
I think Congress should mandate that any product which contains an RFID tag must be clearly labelled as such, and the store must provide you the option of disabling the tag before leaving the store (perhaps a certain device you walk through or something?)
Products that have RFID tags only in the packaging could be exempt, since those tags don't stick with the product.
Natural != (nontoxic || beneficial)
If you microwave your money and blow out the rfid tags will it still be legal tender?
Coding Blog
ok, so in the first part of this article the guy says
"When a transponder receives a certain radio query, it responds by transmitting its unique ID code, perhaps a 128-bit number, back to the transceiver. Most RFID tags don't have batteries (How could they? They're 1/3 of a millimeter!). Instead, they are powered by the radio signal that wakes them up and requests an answer."
Later he throws in this little paranoia bit about "Do you really want your car's tires broadcasting your every move?" What's that about? He knows they don't "broadcast" and that you'd have to be within several feet to monitor. You already have a frickin license plate on your car, so who cares? The good side of that is that you could prove that your tires were now living on someone else's car when they were stolen...
And in that line of thinking, how long will it take for commercial "scanners" to come around, so you can locate the chip and neutralize it? It just seems that people are freaking out about security when in reality, people can already track everywhere you go anyway. How many people out there use cash exclusively? No one I know. I can't WAIT for the day when I just walk out the door with a cart full of stuff and it's automatically taken out of my checking account. that would well be worth someone being able to count how many hammers I buy in a month.
You missed something. They are not exactly like bar code tags. Here you go:
They are like bar code tags, except that they are scanned by electromagnetic sensors through your clothing/belongings possibly without you knowing, and carry enough bit-depth to uniquely identify your specific item (serial number), rather than visible lasers at checkout counters, which can only identify the type of item it is, not exactly which specific item it is.
As you can see, it's a bit more complicated than you would have us believe.
Boom! That's it. Yes, the paranoia is totally and completely stupid.
You're right - there's nothing to fear from RFID tags. What people have problems with are the evil deeds RFID tags could enable.
Again, people need not fear guns, they should fear homicidal maniacs. But like guns, RFID tags take the wrap because they're the enabling technology.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Lighten up. I can't shop at Walmart because I still have all of my teeth, but the cost savings alone (retail inventory every 6 months is expensive in a big store) will make the ROI appealking to managers everywhere.
I can feel the prices dropping now. I also can't wait until Walmart starts putting MY employers out of business, in addition tothe thousands of other small-scale employers that they've already nuked.
To ensure perfect aim, shoot first and call whatever you hit the target
They have many good potential uses (retail stores would never have to do inventory again, which, speaking from experience, is a nightmare.), but there is a GREAT chance of misuse. Unlike barcodes, RFID tags can be updated, and changed. A great example of this is the movie Minority Report, in which the stores know Tom Cruise's character by name, and know what he has purchased (and attempt to interest him in accesories.) What I see as the first, and immediate problem for consumers is returning products. Wal-Mart will know that they sold you a product and if you try to return the SAME product, only purchased from a different store (such as a gift that you are unsure where it came from), they could refuse to accept the return by stating it did not come from their store. Great for the Wal-Mart bottom line, bad for the consumer.
Am I the only one sick of "privacy" being used as an argument? It reminds me of "won't someone think of the children." The Constitution/Declaration of Independance do not stipulate privacy.
I'm beginning to think that privacy is costing us too much. If we had access to a plethora of medical information, perhaps we could do some data mining and identify some patterns that would benifit us more than we can imagine.
I'm trying to remember WHY I want all this privacy, why it's so impoartant my purchases be private, who is it I'm afraid of them knowing that I bought a copy of "swank" magazine. I guess if I was a politcian I wouldn't want people to know some things, but I'm just a pretty average citizen, I don't need someone else protecting my privacy.
Maybe an employer would do a backround check and find something - but if they won't hire me becuase of some obscure piece of information, maybe I don't want to work there. Perhaps I'm the kind of person who doesn't really have something like that to hide... it seems the only people concerned about privacy are trying to hide something. Now I'm beginning to ramble...
M@
Krispy Cream is people
Um, how exactly did bar codes change Big Brother's powers dramatically? Only for bar codes was 1984 a significant year, not for RFIDs.
I'm no expert on RFID tags, but it seems that the signal they emit must be fairly faint if it is only a modified echo of the transmitted query. For passive tags, this means their emission can be no stronger (and in reality must be far weaker) than the strength of the query signal when it reached the tag. Transmitted through three dimensions, my college physics course tells me that these signals drop off proportionally to the inverse square of their distance -- and for RFID, whose query signal must be bounced back without additional power, the distance would have to be double that from interrogator to tag. And then we'd have to factor in the unavoidable inefficiency in the tag itself.
So the signal is going to be faint. Why can't we carry around a jammer? It wouldn't have to be very complicated to function quite elegantly -- it could passively monitor RFID query broadcasts and automatically reply with misleading noise. Since it can measure the signal strength of the query, it could use its own power source to magnify its response by, say, 20%. It seems that should be enough to drown the response from any tag in one's clothing, driver's license, or other effects. A switch could allow the user to disable it when he wants RFID signals to get through -- to have the cashier ring up his purchase, for example.
I can't imagine that the power requirement for extended usage would be that steep -- active (powered) RFID tags theoretically function for 10 years or longer. The circuitry, too, seems like it would be fairly trivial. I'd guess that they wouldn't be significantly more costly to produce than regular AA battery cases. Maybe they could even function for years on the juice of a button battery, and fit the form factor of a credit card.
So why doesn't CASPIAN or anyone else against RFID privacy violations mass-produce these things and sell them online for a couple bucks? I'd grab one just for the coolness factor, and I'm sure lots of privacy advocates would use them too. It'd certainly protect the privacy of anyone using one, and by making the collected data less reliable, even those without would indirectly benefit.
It wouldn't interfere with non-retail uses of RFID tags, since there is a specific spectrum range reserved for retail use -- something like 1.25-8.64mHz. And by introducing a degree of randomness into marketers' data, general trends (governed by the Central Limit Theorem) could still be deduced, whereas individual data points would be significantly less reliable. Hence, the data would be quite useful for tailoring goods to what most people want (a good thing) without allowing individual-level violation of privacy.
As a real security professional (i.e. one that does not go around screaming that the sky is falling) and as someone who has worked with RFID for the military and for civilian uses (mainly Post Offices) for over six years, I find your article makes a number of glaring omissions that would allow any sensible human being to make a rational judgement about this technology.
You are a black pot, and to top it all off the kettle is orange.
Omissions: 1) Range verses size. Very basic issue. The smaller it is, the closer you have to be to it to pick up the signal. For a small passive tag we are talking inches (3-4 feet max). In order to track something from 200 yards (maximum range currently in use), you need an active tag (i.e. with a battery) and it has to be the size of a beer mat. I think you would notice it in your jeans. The signal generator in this case is also a non-trivial device. It is the size on a lamp-post and weights in excuss of 30Kg. Hardly PDA attachment material.
If your experience is as you claim it, I can only conclude that you are intentionally lying. There is no inherent, physics based limitation of "a few feet" to how far these tags can be read: to read the tags from further away, all one needs is a better receiver. Your statement assumes that a newer, better receiver will never be invented or brought to market. Doesn't the NSA do quite a bit of work already on picking up radio signals at a distance?!?
2)Storage area on the device is tiny. For the small passive devices you are referring to the storage area is less than 1Kilobyte. Not much space for your medical records here.
A KILOBYTE? Tell me, chum, how long is an IP address? A MAC Address? An IPv6 address? A 1 Kilobyte serial number is pretty damn big.
3)The logic associated with the tyre scenario. The association of the vehicle number and the tyre would not be stored on the tag. There is no space, and Read/Write tags are much more expensive (and larger). Easy to overwrite also. So for your big brother is watching scenario, you would need to replace every lamp-post on every highway with a signal generator, have assess to the database that cross-references your vehicle ID with the tag ids, and be able to monitor all of the signal generators in real-time to see what was happening.
OK...so...what's the problem? You don't think Big Brother has mastered the fine art of the database? Or a simple message passing network? It's not even as expensive as all that, as you wouldn't really need one for each lamp post, just one for each 'path'. One at the freeway entrance, one at each exit and the same for residential blocks - one at each end. Maybe, on freeways, a few here and there at mile markers and such.
It really seems intentional that you're overlooking the obvious -- that's not a typical trait of a "security professional".
Though I don't have a degree in physics, an EMP should only work on devices that are running current through their circuits. So, if an RFID tag has it's own power supply or doesn't have one (somehow, i'm still not too clear on that part), all you have to do is poll the RFID and then do the EMP pulse while the RFID is responding. This assumed that the device that the RFID is implanted in is completely void of power (ie, batteries out, all capacitors are discharged, etc). Didn't you learn anyhing while watching The Matrix :-)
ok, great. What's to say the cost of production on a more advanced RFID won't happen in one year?
No matter what evidence is shown at this point in time to prove how limited these things are, does _not_ prove anything for RFID tags on the market for next year. Physics or not, someone will find a new material for the antanae, make cheap batteries, make a more accurate reciever, dramatically cut the price of production, etc... and then all the arguments for June 27th, 2003 are completely irrelevant.
A good example is cell-phones, tell me that a cellphone small enough to fit into a pair of sunglasses will never happen. Then tell me that passive RFID tags will never be able to communicate farther than 10 feet...
It's funny, the scientists with the most knowledge tend to be the most skeptical about what is possible...