Blocker Tags to Protect Privacy From RFID Tags

geekee writes "According to an article at CNET, RSA Security is developing a 'blocker' tag that disrupts RFID tag transmissions, protecting a person's privacy from those who would abuse RFID technology. The blocker tag would be embedded in your watch, for instance. This method has an advantage over destroying the RFID tags after purchase because useful information on the tag could help consumers (e.g. laundry instructions)." According to the RSA scientist quoted in the article, privacy concerns regarding RFID have been overblown, but it's still worth being proactive when finding ways to defeat the tags.

Comments

God I hate those tags

[Dancin_Santa]

I haven't ever seen one, nor have I heard of any stores stocking merchandise equipped with them, but the price of Freedom is eternal vigilantism.

Re:God I hate those tags

[joe_bruin]

...but the price of Freedom is eternal vigilantism.

i believe that the price of freedom is eternal vigilance. that's pretty funny, though.

Re:God I hate those tags

[Anonymous Coward]

Next big item on eBay: portable EMP generators.

Excellent. Then the next time some prick wont stop waffling into his cellphone during the movie, I can just take matters into my own hands and blast it into a useless lump of plastic.

Re:God I hate those tags

[Nucleon500]

Excellent. Then the next time some prick wont stop waffling into his cellphone during the movie, I can just take matters into my own hands and blast it into a useless lump of plastic.

But then you'd be helping the MPAA, by stopping the flow of text messages complaining about the movie!

Shoplifting?

[ksuMacGyver]

Wonder how this would affect shoplifting? Just wear the watch and walk out $0 deducted from your bank account?!

Re:Shoplifting?

[psyco484]

Win enough illegal search and siezure (sp?) lawsuits and they likely won't bother you. This is of course assuming you're not stealing from them.

If the cops can't search my car without consent or a warrant, I'll be damned if a supermarket clerk can search me.

Re:Shoplifting?

[eht]

They'll make a Anti-RFID detector and you come in the store it goes off, sorry sir, you can't bring that in here.

Quite a few stores won't let you shop carrying a backpack, so I figure they'll do sometihing along those lines.

Don't like it? You don't have to shop there and they have the right to refuse you business as long as they aren't discriminating against a class of people(I don't think paranoid is a legal class of people).

Going lotech

[Empiric]

Juels said that he foresees a day when tags in clothes can tell washing machines the proper way they need to be washed.

This just seems like really stretching for a scenario in which RFID tags will be useful beyond inventory tracking (What happens when 5% of your laundry says "warm" and the rest says "hot")?

Before paying RSA for advanced laundry stealth technology, I think I'd first try something a little more straightforward, like a few seconds in my microwave.

Re:Going lotech

[acceleriter]

Is it bad if my mind was in the gutter and I knew she's the robot from the Jetsons?

Re:Going lotech

[Zork the Almighty]

What happens when 5% of your laundry says "warm" and the rest says "hot" ?

Your washing machine blue-screens and sends an error report to Microsoft.

But...

[cliffy2000]

Just remember to take off your RFID blocker watch before trying to get on a plane. Try explaining THAT to airport security:
You: "It's a watch that protects my privacy from the invasive government by sending out waves of non-dangerous radiation!"
Them: "Terrorist!"
You: "But it's just radio wa-wahhhhhhh!" *getting taken away in handcuffs*

Is that legal?

[PeteQC]

is that legal to block radio frequency? Isn't it the same problem that movie theaters came across when they wanted to block cell phones' frequency but they can't because of the law?

IANAL, but I think it may not be legal!

Re:Is that legal?

[BigDish]

With current laws (unless this gets called a circumvention device under the DMCA) it would be legal. This is because the RFID tag will be unlicensed and fall under part 15 of the FCC's rules. Cell phones, on the other hand, are in licensed spectrum, and transmit with much more power than part 15. Part of the requirements for a part 15 device to operate is it must not intentionally cause interference (ie blocking a cell phone) with another, LICSENCED device (so interfering with an RFID tag is OK, cell phone is not) Additionally, most likely power levels greater than part 15 would be required to block a cell phone transmisssion. So in short, this is legal, call phone blocking isn't.

This sets a standard.

[Obscenity]

If we let companies use these tag's, we are saying to them "We are ok with this." And of cource in the future (near or far) they will click it up a notch. Sooner or later, they will invade more of our privacy, under the guise of "targeted advertising". Weather there is much privacy lost or not is not an issure, the fact than we are allowing this to happen shows the companies our mindset. We are not going to fight back aganst these kinds of intrustions. Or are we?

Build security in from the beginning...

[mnmlst]

What a concept! Near the end of the article is the quote about how hard it would be to add the blocking capability at a later time. I would hope these guys are looking at a LOT of security aspects to this technology before they unleash it everywhere. Interestingly, Business 2.0 is currently running an article on Burlington Northern Santa Fe Railroad (BNSF) and how they have just now really begun to get "wired". Naturally, they are using a lot of RFID technology to track their rail cars. As recently as ten years ago (when I interviewed with them) they were still using paper and pencil. Sometimes an engineer would stop a train and call back to the dispatcher on a pay phone. Bring on the RFID's. MOM, I want a train!

Nah, it will be like another set of pricacy tools.

[twitter]

Remember "private" phone listings? What a scam that was. The phone company sold your name and number to direct marketing creeps who then annoyed you day and night. To help you out, the phone company sold you an "unlisted number", which kept your friends and relatives from being able to contact you. The phone creeps could still get your number and you still got annoying sales calls. The phone company then sold you caller ID and creeps ID blocking. So the cycle rolled, with extra money for the phone company and the rest of the world as screwed as possible.

I have no faith in a blocking tag. Retailers will set off alarms every time you leave a store if you block their signals and readers will be made to defeat them in time. All you will get out of this evil technology is more grief, just like the phone system. The root of the problem, customer data retention and sale, is what needs to be addressed.

You'll pay and pay

[frovingslosh]

One of the advantages being promoted for the tags is that you'll be ableto take a shopping cart, just run it through the checkout line, and the scanner and RFID tags will quickly add up everything in your cart. You can expect this technology to become as prevalent as bar codes are now. But with such a system and tags that are not disabled after you leave the store, you're likely to end up being charged again for your shirt, or watch, or underware or shoes or some item in your pocket with an embedded tag if you are close to the cart when it is scanned. It will become the new way of scamming the customers, soon to exceed the scan prices often being higher than the shelf price but never being lower.

I wanna subscribe to your newsletter

[serial frame]

Wow, this is awesome !! This is one step closer to things like, watch-sized EMP death rays.

I've always wanted an EMP in my watch.

Easy

[Anonymous Coward]

just place clothes in microwave, high power for 10 seconds

no rfid :)

just dont touch that zipper (ouch hottt)

Price fixing?

[Izago909]

So a great part of the RFID hype is over preventing theft. When they are implimented, and theft rates drop, will they drop their prices too? They (corporations) claim that theft and other losses have a large effect on prices. Do you think they will prove themselves wrong?

Along the lines of buildign a better mousetrap: How long will it take a theif to discover a way to neutralize these tags? What happens when a person walks out of a store with a cart that has 30% of the tags inactive? How will anyone know that s/he hasn't paid for everything?

RFID Silliness

[ticklemeozmo]

Seriously, how long does it take to seperate whites from darks and if you are in that serious need of time, you have a scheduling issue.

On a tin-foil-hat note: this is how freedoms are taken away.

• "It's for convienence!"
• "But it'll save time... no one is going to monitor what types of razor blades you buy."
• "If you just swipe your finger, you'll check out quicker, save time and money 5% off to customers who use RFID!"
• "I'm sorry, but it's a requirement that all people have RFID tags in their heads. well, people were cutting off their fingers to not be tracked by us. And anyone who doesn't submit to InstaTrace is considered a criminal."

I hate to sound like a Montanian, but consider this when security and freedoms are concerned (I forget who said it, didn't bother googling).

"When you draw a line in the sand, and step over it, it does not appear to be a big step from your last position, so you allow it. But if you continue to allow it, over time, you will realize (albeit, probably too late) that you do not have your original position in sight as you turn around."

Spoofed RFIDs

[MoogMan]

I think it would be cool to have a system where a device sends out all (or many) RFIDs to confuse a reciever.
Another thought is that it could send out a bunch of random RFIDs thus (hopefully) protecting anonymity but keeping statistics useful?

URL to Rivest RFID blocking paper

[karl.auerbach]

In case anyone wants to read the original paper on this it's at:

http://theory.lcs.mit.edu/~rivest/JuelsRivestSzydl o-TheBlockerTag.pdf

How is RFID going to work in practice?

[Rogerborg]

The only way that I can see it working is if stores keep a record of all RFIDs that they have in stock, and then only charge you if the RFID matches when you walk out.

How are they planning to actually administrate that? Scan all products on the way in? So they shove a pallet full of Chocolate Frosted Sugar Bombs though their stock door and a mondo scanner reads the RFIDs off of every box? Or do they scan a barcode or type in a code that just says what should be on the stack?

What I'm interested in is the possibility of deliveries getting screwed up and RFIDs getting entered into the wrong systems. There's the problem with buying something at store X then store Y thinking that it belongs to them, but there's a problem for the stores as well. If you want to buy something and for some reason the RFID isn't on their system, how do they sell it to you? And should you buy it, knowing that the RFID might appear on their or store Y's system at some point?

And given that the biggest theft problem that many stores (especially supermarkets) face is employee theft, do they need RFID scanners on all their doors? If stock does go missing while it's still on the system, what happens to those RFID numbers? Do they just sit in there indefinitely, or is there a plan for removing them? What happens when Joe Customer walks in wearing or carrying something that he's bought second hand from an employee or shoplifter who obtained a five finger discount?

It won't take many of these incidents to put a hell of a dent in consumer confidence over RFID, quite aside from the privacy issue of stores knowing that you're wearing a rubber g-string and fishnet stockings under your suit pants.