Estonia Tests "Contactless" ID-Cards

borkee writes "Estonian MEAC and CMB start testing a new version of a national ID card containing what they call 'contactless' extensions. Although they do not specifically disclose to us, taxpayers, what technology is used there, it must be quite obvious that it's nothing less than RFID. Add to this, they'll have person's biometrics in memory. (Security gurus of course know: biometrics just don't work.) Soon you can track us poor Estonians by our GSM phones and by our ID cards too!"

Comments

Re:In Soviet Estonia..

[meringuoid]

The depressing thing is that Estonia actually WAS in Soviet Russia. I don't recall that they were particularly happy with the situation.

You'd think that the ex-Soviet countries would be really protective of their new freedoms...

so ?

[DZign]

like someone wants to track you ?

and as always when new technology is introduced, it will probably take a long time (let's say 2 years or so) until every department (communal house, police department, hospital,..) which needs to get information from your id card, will have the correct reader installed, so until then it's used the old fashoned way.

btw are you guys required to have your id card with you all the time ?

Re:so ?

[asd-Strom]

No we don't need to have our ID card with us all the time. It's required to own a card if you're older than 15 but you could just keep it home in a box.

Re:so ?

[Kjella]

like someone wants to track you ?

No, they're not interested in the average Joe as long as he remains that. But should he ever become or try to become someone of power and importance (or just too annoying), they'd love to have all sorts of dirt to wreck your life, career and credibility. It is considerable leverage both to prevent you becoming an influence, and controlling you if you do.

The KGB etc. were notorious for collecting vast amounts of information. Most of it they never needed, but they had it in case that person was turning out to be a problem. As long as you are a good little pawn and do nothing "wrong", there is no problem. That was true even in the Soviet union. So then you don't have any problem with them gathering this information?

Kjella

Re:so ?

[Anonymous Coward]

In Soviet Russia, they--uh--the, no wait...um--I'll get back to you on that.

Re:so ?

[DZign]

I'm also from Belgium so therefor my question too.

I guess we're used to having it with us always and don't find this weird.

It sometimes amazes me about all the fuzz some countries make (UK now, but otoh, UK is against just about anything new :-) when id cards are introduced,
or I sometimes just wonder how countries like the USA can even operate well without id cards or anything like that.

OK in the USA they use the social security number or driver license as id card, which gives problems with id theft because your unique key (which would be on your id card) is also used for other functions. Why not just put this unique key on your id card and only use it for identifying you ?

OK people say then want to be free and do whatever they want. Bad luck. At the same time you want to get social security, get unemployment money, drive a car, and much more, so at least prove who you are when you want to cash that check.

Having an id card and not needing to have it with you also gives the possibility for abuse.
In the end the 'good' people who don't do anything wrong aren't bothered by it, and at least it can stop mis-use by people who want to defraud the system.

Recently there was a program on tv about people in France driving without driver licenses (driver license with points, have to many violations and they revoke it), one of the guys had a friend who looked like him, so if he got stopped he said to the policeman he didn't have his papers with him, but his name was Y and then this friend would go to the police station to say he did the offence.
Duh.. At least these kind of things could be stopped if you needed to have your papers with you all the time.

That's only one example, I guess there are many more you can come up with in which people commit fraud by saying they're someone else.

Re:so ?

[Pogue Mahone]

This begs the question "is the a free world inside America?"

Posted anonymously to avoid observation by the KG^H^HDHS. Oh, damn...

Re:so ?

[pjt33]

When you go to an international airport, you should make sure your mobile phone is turned off, or people will clone it on the grounds that you'll be out of the country and won't notice for a few weeks. This contactless technology is looked upon favourably by Blunkett, so I face the prospect of having to take my passport to the airport wrapped in a Faraday shield to prevent people reading the information and burgling my house on the grounds it will be empty for a few days.

Re:so ?

[DZign]

I'm not defending rfid's in id cards, I wouldn't like it myself either (as we always have to carry them, technically we would be easy to track then if there ever was enough infrastructury for this rolled out).

I just wanted to say that id cards in general are not a bad thing on themselves.
I wonder how other countries do without, and if this doesn't give more possibilities to for mis-use and fraud.
My impression is they can be useful and help society in general, if used properly.

However, people on /. always suspect the worst.
OK anything can be misused and there should be strict rules what can (not) be done with them.

And indeed, to answer (2) I was speaking about law-abiding citizens.

Hmm. Now thinking about all this, I was going to write that people should at least have some trust in their country and they live (at least most of us) in a democracy. Just made me realise that I'm too optimistic about this and most governments are corrupt and imo democracy doesn't work. But that's another discussion.
And extreme-right is becoming more popular here so the gestapo-reply by someone else here could actually become possible in 10 years or so. But that's worst case scenario..

Re:so ?

[Oddly_Drac]

"It sometimes amazes me about all the fuzz some countries make (UK now, but otoh, UK is against just about anything new :-) when id cards are introduced,"

It's not that we're against everything new, it's more the clouds of spurious chaff thrown out by David Blunkett, the curious quantities of ignorance shown to con arguments and the ludicrous execution of said that tends to suggest that the taxpayer will end up shelling for a form of identity that *should be* adequately covered by photo driving licenses and passports.

I should point out that the latter two identification methods have been redesigned in the past decade to stop counterfeiting, but in the case of the passports, blanks were on the streets within two weeks of the unveiling. Saying that you require another piece of identification is a tacit admission that your system is compromised, and we should be fixing those systems (seriously, I'll say it again...passports) rather than introducing another.

One of the reasons why this isn't necessarily the case is that the real kicker for a national ID card is the national ID card database; that's why this is being pushed so hard.

"At least these kind of things could be stopped if you needed to have your papers with you all the time."

Yeah, we have photos on our driving licenses now. The procedure is that you're given a document that indicates what you need to go into a police station with, then you have to present them within seven days or you'll have a warrant issued for your arrest. That's the UK method.

"At the same time you want to get social security, get unemployment money, drive a car, and much more, so at least prove who you are when you want to cash that check."

To take your points;
Social Security - We in the UK are issued a National Insurance number at 16. This is a primary form of identification because it links back to the Inland Revenue and the DSS. The same for unemployment money.
Drive a Car - Photo driving licenses that are backed with a database at the DVLA in Swansea. Incidentally the same place that records your car ownership, and the primary database queried by police.
Cash that check - Signatures are still considered the best form of identification for this, and most banks can call up a digitised copy of your signature for checking. I tend to carry my passport if more information is needed.

In terms of confirming your identity in the UK, most times a photo id is requested (passport, students union, driving license) along with two utility bills or bank statements.

This creates an 'intersection' of supporting information rather than relying on a single piece of documentation; a national ID card would be a single piece of information for which the only checking tools will available to law enforcement and government; given the record of other forms of ID, it seems unlikely that this will patch the hole it's intended for.

Re:so ?

[Anonymous Coward]

"If you are being stopped by the police it's because they have real reason to suspect you of something"

Really? You're obviously white, middle-class and living in a nice part of town. ID cards are widely used to systematically harass ethnic minorities and anyone else the police decide they don't like the look of. This is especially true in a country like Belgium, which I recall being critisised by Amnesty International for exactly this kind of Gestapo behaviour.

Re:so ?

[the chao goes mu]

Not just minorities. Try being white and entering a "known drug neighborhood". Worse, try being white and living in or near one. It is almost as if being white in the wrong part of the city is a crime.

Info on Biometrics not being safe ?

[acebone]

Where can I read about biometrics not being safe ?

That's very interesting, and I've never heard about it before. I mean surely the pattern in your eyes and your fingerprints are unique and does not change, no ?

Re:Info on Biometrics not being safe ?

[Frogbert]

Thats the point, your eyes don't change, your fingerprints don't change.

So as soon as someone has your fingerprint they can just make a fake thumb and be you anywhere they go.

Re:Info on Biometrics not being safe ?

[Sique]

Biometrics have a limited recognition rate, that means: a considerable amount of false positives (wrongly identified) or false negatives (wrongly refused). Often all you can do is having a compromise, either admitting the false positives to have less false negatives, or having lots of people wrongly refused by the system, so the human operators have to manually sort out the remainings.

Due to the limited recognition rate, you can often easily fool a biometric scanner. Face recognition systems are often fooled by holding a picture of the right person before the lense. Same often works for iris scanners. Finger print scanners can be fooled by fake fingerprints made from wax (stearine). Hand scanner sometimes are easiest. Cut out a cardboard with the right hand profile.

Most of those biometric scanners thus should never run unattended, to minimize manipulation as stated above. And if you have humans watch the scanners, you could as easily have those humans perform the checks themselves, probably getting better recognition rates.

Biometric scanners may give you additional security, if you use all the common methods like picture ids, signature and similar too, because now an attacker has not only to disguise himself accordingly, but has to fake the biometric data too. But without a central database for crosschecking the data, its rather meaningless. If he can fake a picture ID with his face and a false name, he can also fake the biometric data to fit his own data. As a stand alone tool the biometric scanners are not really ready.

Re:Info on Biometrics not being safe ?

[fenodyree]

When I think of Biometric ident usually fingerprints and iris's come to mind. The former is quite simple to fake as shown by gummy bears. The latters complications are discussed here, with methods ranging from simple to replacing an eye or digging one out. It seems the most secure form of ident would be through DNA, however we all know the dangers and benefits associated with cradle to grave tracking.

Re:Info on Biometrics not being safe ?

[datajack]

Yeah, the technology may be able to change to deal with a new way of fooling the existing tech.

Let's step back a bit and look at the two things needed for an authentication system...

1. Input device - the means to input the credentials into the system. These include fingerprint scanners, and keyboards for passwords etc.

2. Credentials - Fingerprints, passwords, one-time codes etc.

Traditionally, every outhentication credential can be copied or stolen eventually. So, if someone learns your password or steals your smartcard, then the sysadmin can disable it and issue a new one.
Who wants to be the first volunteer to be issued with new fingerprints?

Oh yes, the technology will evolve to be able to detect a new method of faking 'prints, but this will involve replacing or upgrading every authentication terminal in use, a hugely expensive task - a sign of a fundamentally broken idea if you ask me.

Re:Info on Biometrics not being safe ?

[nzgeek]

There is only one of you. You have one set of fingerprints and one set of unique retinal patterns.

If someone manages to compromise this, say by lifting one of your prints off a discarded coke can, or removing one of your eyeballs, then you're - as the kids say - 0wned.

Sure biometrics may be mildly harder to compromise than a password, but a password is a hell of a lot easier to revoke if it has been compromised.

Re:Info on Biometrics not being safe ?

[sql*kitten]

I mean surely the pattern in your eyes and your fingerprints are unique and does not change, no ?

That's the problem, if an attacker can bypass the sensor and feed data directly into the recognition engine (which can be as simple as splicing a few cables) all he needs is a copy of your biometric data (which he can get from doing the same thing to any sensor you use) and he can present your authentication credentials anywhere that biometrics are used.

If your credit card or passport is stolen, it can be blocked and a new one issued. If you lose your PIN number, you can have it reset. If an identity thief obtains scans of your fingerprints, retina, etc, then you're stuck - no way to replace 'em, see.

And THAT is why biometrics are stupid - once compromised, they're compromised for good. Present-day systems are based on matching something you have (your card) with something you know (the PIN) to prove you are who you say you are. You can also have a system based on something you are (say your fingerprint) and something you know (a PIN). But relying on a system that is wholly something you are is so stupid it's just embarassing.

Re:Info on Biometrics not being safe ?

[R.Caley]

Can't say about retinal or iris patterns, but fingerprints are so dodgy, even when compared by experts, that the US government felt the need to ban funding of any study into how reliable they are. (New Scientist report).

I think we can assume that if they thought the results of such a study would be positive they would be pouring money at it, in the hope of being able ditch that embarassing `images are very like themselves' study.

Re:Info on Biometrics not being safe ?

[panoplos]

While all the points you mentioned are valid concerns, especially False Acceptance Rate (FAR) & False Rejection Rate (FRR), there is technology that overcomes most of these limitations.

Have a look at AuthenTec's TruePrint Technology. In summary, "TruePrint Technology uses a patented radio frequency (RF) imaging technique that allows the sensor to generate an image of the shape of the live layer of the skin that is buried beneath the surface of the finger." This makes spoofing of fingerprints nearly impossible.

In fact, AuthenTec are quickly dispelling the myth that biometrics are inherently insecure. Have a look at the Fujitsu's hot-off-the-factory-line F900iC [Japanese]. This is the first phone to fully encorporate mobile commerce (m-commerce), and all authentication is performed via that tiny AES2510 AuthenTec swipe sensor.

DoCoMo (think: user base in the millions) would be mad to trust a technology that you suggest is "not really ready."

And yes, I work for AuthenTec ;-).

Re:In Soviet Estonia..

[chimpo13]

I'm sure they are protective. This was probably put to them in A Good Way. It's doing THEM a favor. No point in carrying cash, when you have credit cards which are protected even if stolen.

Take it to your own level of whether this is good or bad. I'm sure the comment arguments have already started.

Sweeping statement

[ItsIllak]

(Security gurus of course know: biometrics just don't work.)

They do? There are plenty of viable biometric measurements out there. They are not 100% reliable, but when compared to wetware trying to remember passwords they stack up pretty well.

I for instance have a finger print reader on both my palmtop and my desktop. In the limited environment I have, they identify and authorize perfectly well.

Re:Sweeping statement

[Znork]

"I for instance have a finger print reader on both my palmtop and my desktop."

And everyone else, for instance, has access to your fingerprints on every object you've touched in recent time.

Or are you using gloves?

Re:Sweeping statement

[Amiga Lover]

Almost all security is simply a means of raising the cost of hacking it to a level above it's value.

You are completely correct, and I have implemented a cunning plan that has made the effort of hacking me not worth doing.

I have no life, no job, no financial prospects and no worth to my identity. I plan to soon get a criminal record and become a terror suspect. Eventually I will also return my internet connection to a 2400bps modem, and will be insanely secure, as there will be no worth in breaking my security

Take that, evil hackers of the world, TAKE THAT!

Re:Sweeping statement

[Alsee]

the resources to fabricate fingerprints that will fool the reader...
Almost all security is simply a means of raising the cost of hacking it to a level above it's value.

It has been well established that cost and resources involved in defeating a fingerprint scanner amount to little more than some gummi bears.

-

Re:Sweeping statement

[Alsee]

How does one go about making use of those finger prints

Google knows all.

how hard would it really be to make a system that defends against false readings?

Apparently very hard. It seems that all commonly available scanners are easily defeated by Gummi Bears.

-

Re:Sweeping statement

[maxwell demon]

Well, with a criminal record and being terror suspect, I guess there are some agencies which would be very interested in breaking your security.

pardon my ignorance, but

[v1x]

Admittedly, I dont know too much about the Estonian political system etc, to comment on the issue of choice, and how much of it the people there had when their government decided to introduce such a thing. However, it has been my experience that outside the US, a lot of cultures dont seem to make that big a deal about privacy, so maybe it is not that big a deal after all to Estonian citizens.

OTOH, RFIDs have already been implemented by clubs, etc to have painless billing, etc, so there are at least a few people around the world who dont think they are that big a deal.

Living in the US, however, my own fears are based on what I have heard about the privacy issues surrounding such technology, in that anyone with a scanner can find out a dangerous amount of information about you without your knowledge or consent; so to me it seems like a bad idea at least until someone can manage to convince me otherwise about how my information will be protected.

Re:pardon my ignorance, but

[pe1rxq]

Actually outside the US privacy laws are often a lot stricter.....

Cool

[c0dedude]

This could have some nifty scientific uses even if you can't decrypt the data. Just think of the sociological experiments. Knowing exactly who's on what road, when? Who shops where? The possiblities are mind-blowing. And the sample would be great because it's taken from the public.

Broken

[0x0d0a]

A good ID verifying-device (card, token, whatever):

* Does not contain or rely on biometrics. Generally can change, and once copied/forged one can never change the identifying information.

* Is capable of doing public-key encryption on-card. The information that identifies the person never leaks to the device. (Technically, this can be done with symmetric encryption as well in conjunction with a trusted centralized server, but this has some drawbacks.)

* Has a PIN, so that stealing the card is not sufficient to impersonate a person.

* Has a PIN entry keypad *on-card*, so that false readers and bogus ATMs cannot steal PINs.

* If any data must go back to the card owner, has a rudimentary display *on-card* (say, a calculator-style LCD display), so that a false reader or bogus ATM cannot say that someone is paying "$10.00 to WalMart" for something and actually having them pay "$14.00 to Joe Hacker".

* Should support a scheme where personal identity is not disclosed, but a persona is (my "persona" at the moment is "0x0d0a"). This is because any national ID card will naturally be used by other systems as well, and without this step, severe privacy abuses will occur. This requires use of a trusted, centralized server or of a card that can natively store multiple identities.

* Allows one to disable the trusted nature of the the card quickly and easily if it is lost, and in a manner that cannot be easily done by others (which would allow a denial-of-service attack against the card owner).

* Can handle water, crushing force, and high temperature.

* Can fit in a wallet.

* Should have the ability to log identity verification usage, so that the user can sync his card up with a computer or similar and check to see what he actually signed off on two days ago.

This certainly isn't a complete list of desireable characteristics, but it's a start.

Re:Broken

[Beautyon]

is a system that relies on a mix of documents that you choose to provide, and not something provided to you by the state, no matter how cool it is.

Estonians, dont whine about ID cards; do what the Australians did and refuse to carry them at all.

Your government will withdraw the scheme. Guaranteed.

Re:Broken

[Serious Simon]

A good ID verifying-device (card, token, whatever): * Does not contain or rely on biometrics.

If it contains NO biometrics at all, it becomes very difficult to make sure the ID actually matches the person presenting it. Imagine a passport without a photo or any other biometrics...

Re:Broken

[0x0d0a]

PIN-entry on card. Right. Like my ATM is going to believe your card when it says you have the PIN. That's like rsh, except with money. You go first.

In smartcard-like systems (which differ from credit card systems), the PIN is not for the benefit of the ATM -- the smartcard would *never* hand over a PIN if it could get it directly from the user. As soon as you enter a PIN in smartcard, the ATM hands off the PIN to the smartcard and then is supposed to promptly "forget" about the PIN. The PIN is just what tells the smartcard that it should sign/endorse/do whatever the ATM hands to it. Generally, smartcards disable themselves if they get several bogus PINs in a row, as a matter of fact. The only reason for putting the buttons on the machine is that it reduces the unit cost of the card and lets you put buttons with nice texture and feedback.

As a matter of fact, cell phones could already provide much of this functionality onboard (though cell companies would be *certain* to want to route purchases through their own networks and take a cut, rather than just using IrDA or similar to talk directly to the ATM), and the FBI would be sure to want the phone to broadcast where you're using it and the like. Sigh.

I'm also wondering how I'm going to send someone payment without sending them personal information.

You don't. Your card-issuer (or a proxy, if there's any interest from card-issuers in providing anonymized transactions, which I'm guessing there won't be. :-(

Here's the data that goes back and forth in such a system:

1) You stick card into reader. Reader provides power, card powers itself on.

2) You enter PIN. Card notices that PIN is really yours and decides that "you are you", and allows you to authorize things.

3) ATM sends "WalMart, $55.95" to the card.

4) The card displays "WalMart, $55.95 on its display".

5) You hit "okay" on the card (probably doubles as one of the number buttons).

6) The card signs the following tuple ("12529134131", "WalMart, $55.95, 3451", where "3451" is an internal counter to the card that is incremented each use -- this prevents replay attacks, much like the serial number on a check), and sends it back to the reader. "12529134131" is a number that identifies you. Note that this can be anything, which is why such a system allows disconnecting personal information from your identity that WalMart can see. You could have just one, as debit card/credit cards currently have. You could have a number of "personas" on card that you hit a number to choose between. You could have a large store of one-time-use, pre-approved numbers on the card that are just moved through, one by one. This prevents Wal-Mart from tracking you, but gives them an identifier that whoever is holding your account (probably your card vendor or a proxy) knows maps to "you".

7) If you have the required money, the account-holding-server can return a response containing a tuple of "authorized" and all the data that they were previously sent (this prevents attacking transmission lines to ATMs and sending bogus "authorized" responses) signed with their *own* private key.

8) The reader checks, decides that the response is good, and gives you a recepit.

If anything, this is *easier* to use than a credit card, because the interface on a given, hell, I dunno what to call a button-and-display-enabled smartcard...(say, "brilliant card", in the vein of the "smart rocks"/"brilliant pebbles" anti-ICBM defense), brilliant card, is the same each time. With a card reader, the user has to figure out something different each time.

And for the life of me I don't see why biometrics couldn't be used in conjunction with other ID methods for enhanced security.

In theory, they could, as long as all ATMs/readers *strictly* never trusted biometrics alone, and required a second, strong form of authentication. There are two main drawbacks: (1) this destroys any possible vestig

Biometrics DO work, when used appropriately

[leereyno]

People just don't understand what biometrics are for. They are not appropriate as a primary means of verifying identity, but they do work well as a supplement to other methods.

I think the problem is you've got some sales monkeys who are selling the idea of biometrics as an authentication pancea to pointy-haired types, which is just further proof that non-technical people should never be in a position of authority or act in a primary decision making capacity where technology is concerned.

RFID or contactless?

[Anonymous Coward]

I can't read the article, but are you sure it's talking about RFID? Contactless smartcards are different to RFID tags. Maybe the paranoia's well founded, but there is a very important difference between an application card which can be pressed to a reader rather than inserted, and a tag which is designed to be tracked from several feet away.
Which is this?

Mmmm... Possibilities :)

[Anonymous Coward]

I dont't think, it's too hard to format this lil' pecker and rewrite the data, when the specific card readers/writers become aviable. Since it's contactless, U don't have to show the real pic on the card anyway.

And about this GSM-tracking? I'd like to whack that bastard who came up with the idea to bring this to the public. It's pretty dawm hard to give your girlfriend impression you're doing overtime @work, when your phone puts you in the strip-club.

GSM-LocatorSimple.

Isn't Estonia

[rf0]

where Dilbert always goes on business trips?

Rus

Re:Isn't Estonia

[Anonymous Coward]

The country Dilbert always goes to is Elbonia.

Some Considerations

[Trailwalker]

Estonia has a large non citizen population, mostly resettled Russian nationals. There are serious questions about who is a citizen and who isn't.

This, and other problems that arose from the long term Soviet occupation make a secure method on identification necessary.

Under their circumstances, the Estonian Government believes security is more important than privacy.

Circumventing the technology.

[hashwolf]

Tinfoil hat wearers might try the following method:

1) Fry the electronics in the card by putting it in a microwave oven etc.

2) Report the card as lost and get a new working card.

You can then keep the working card wrapped in tinfoil and use it only when you really need its identification technology.
Otherwise use the card with the disabled electronics as you would use a 'normal' ID card.

Sounds like there will be a market for...

[The Fanta Menace]

...Faraday-cage id card wallets

Re:In Soviet Estonia..

[gl4ss]

... then they will know also that rfid or _ANYTHING_ ELSE TECHNOLOGICAL "TRACKING" has very little to do with being a police state or not(rfid is just a number anyways that just happens to be readable wirelessly).

being a DDR like hellhole is a _social_ _people_ problem, not something that just spurs out of technology. you cold have a super invasive super bitchy governing system with just people and hard sticks.

besides than this I would bet these id cards to be similar to bus cards, that you would have to place them in a reader anyways(no 'secret' reading). the id cards would probably have the same stuff in them that finland has in it's new electronic cards that allows for digitally signing some papers & etc, allowing you to file some papers through the net.

besides, they won't probably be mandatory to hurle around just to get to the next city. you would be surprised how much the store clerk at your local neighbourhood grocery store remembers about you as well...

the cold hard fact is that information _will_ be gathered about you, it's what the goverment(or other organizations with power) does with that information that matters... but this is nothing new. information was always gatherable about anyone(hell, even usa has long tradition about gathering information about labour activists through private detectives and using that to.. umm. well - kill them.), in ddr they could just ask the kids if they wanted dirt on a family(or just made it up).

The problems of Biometrics

[jetmarc]

Once you detect fraud being done with your biometric identity,
where can you revoke your fingerprint and have a new one issued?

Ummm, you hate privacy?

[Joe 'Nova']

Before this gets labeled flamebait, this kind of intrusion really pisses me off.
The problem with this technology is it not only tracks you, it will allow tracking of your activities. What you buy. Where you go. The ability to, for good or bad, compile a docier on your life.
The only thing preventing this from happening before was the sheer logistics of it. Now that its real, I would like to wake people out of slumber.
I mentioned the ability to do good. I might even call them selling point excuses:
Tailored ads. Stand in front of a Coke machine with reader-"Mr. Jones, you like Cherry Coke! It's been a while since you've had one! Go ahead-we won't tell the Other cola co.!" This ad is beamed into your head(REAL technology-trial balloon tested in Japan!)-another distraction. If they are powerful enough readers, billboards changes to emphasize something in area based on your personal tastes.
Use for convenience. Make it a feature before it becomes mandatory.
For inventory/shipping control. Box 'a' has XXX going to YYY. You don't even need to scan for it directly.

Look folks, Walmart is forcing the use of tags on all their products. If the reader can read your RFID, it can read those too. Instant knowledge base of all the things you do, what you buy, or don't. Become a nonprofitable customer not well dealt with. Ack.
The potential for abuse is way to great. I have heard of no laws about the use of RFID tags. Right now they are being used on Gillette razors, being very expensive and easily stolen. Problem is, these chips are being made by the billion. You tryin' to tell me they sell BILLIONS of razors? Bah! There are 'plastic watch' chips for military use, used in Haiti for the refugee crisis.
Some tech specs-they are supposed to be burnt out at time of purchase, but they aren't, possible shielding on metal products(cans, etc.) Current readers have up to 20' read range. To deactivate them, microwave for a few secs, but set item on fire. Some are embedded in sandals. That would come in handy for tracking you. Unless you are an anti 1984ist(wow!, created a newspeak!), this should start to sound nasty. Someone with a scanner with devious intent could know all about you by scanning your curbed Hefty Cinchsack. Take an item, plant at a scene of a crime. *knock knock* "Mr. Jones, we have evidence that links you to...."
Like I said, there are ZERO laws concerning the use of these buggers. No search warrants, just scanning.
I try to be well informed, but biometrics seems better, because you know when they are being accessed, but still intrusive. With this junk(RFID), you will have the Law of Unintended consequences knocking on your door.
There are way too many possible abuses to go into, thx for patiently reading rant.

"The" local language my ass.

[Kickasso]

A full one third of the population there speaks Russian. It is a local language whether you want it or not. Compare the situation with that of the Swedish language in Finland. Shame, I tells ya.

In Finland....

[dnaumov]

It has pretty much always been possible to track any given persons GSM mobile phone. You wouldnt believe the amount of crimes this has helped solve and prevent as well as the amount of people who get lost and get found only thanks to their phone signal. Everyone I know owns a mobile phone. Everyone I know KNOWS that you can be tracked through your cellphone. I am yet to hear ANYBODY complain.

libertarions unite!! whine about RFID

[Anonymous Coward]

Isn't that what this is?? If a secure way can be found to implement RFID isn't that a good thing?? Small losses of personal liberty when we have a global threat to non-muslims seems imsignificant. Chose your priority, life and security vs. political correctness. Oh Nancy, I'm afraid!!!! If want to improve RFID technology, be part of the solution, dont just be a group of frikking whiners like usual.

Re:national id cards... all countries have them

[trout_fish]

A passport is not the same as a national ID card. No one is required to hold a passport, so can refuse to show it, or pretend that they do not have one. The same goes for driving licenses.

A compulsory national ID card is very different. You cannot claim not to have it, and hence can be required to produce it - even if that requirement is not immediate.

Way too geeky, and miss the point.

[GuyFawkes]

I _AM_ me, not only do I know this for an ABSOLUTE FACT, but those people that I know (family, friends, lovers, ect) also know it (and vice versa of course)

Outside of a body-snatcher type science fiction film I am my own walking talking biometric identifier, even a 20-seconds-to-complete perfect genetic clone still won't fool anyone unless you can ALSO fill that perfect genetic clone with a perfect copy of my brain and memories, attitudes, experiences, dreams, fears, etc etc etc.

The idea that ANY subset of that data can be used to identify me with a usefully high positive degree of accuracy and a usefully low negative degree of accuracy is patently retarded.

Biometric ID was essentially instroduced by the police, in the form of fingerprints, eg on a murder weapon, as a method of tying one unique individual amongst many to a specific event at a specific time and place via a specific identifier, eg the fingerprint.

Fact is the fingerprint, far from foolproof and not that hard to fake (and getting easier as time passes) is still the best, in that it is fairly unique, but it still takes significant human detective effort to match a print to a suspect.

The advent of DNA testing has NOT improved accuracy (english law is already littered with example of overturned convictions that were based on flawed DNA evidence), it has lowered it (the billions to one stuff is bullshit, DNA tests do not match you entire genome, just a few (literally) nodes, most of whom you will share anyway with genetically similar humans, eg people from your area, especially distant relatives.

Adding extra bits of data, eg iris pattern, blood type, known allergies, pantone skin colour, proportion of mercury or other heavy metals in the body, can ONLY EVER INCREASE ACCURACY is the police detective / forensic sense, when trying to match a specific individual to a particular event at a particular place and time.

IT WILL BE NO BENEFIT WHATSOEVER as a general everyday method of identifying "me" from "you", and using that ID for the purposes of granting or restricting access to something, eg my bank account or workplace computer.

ON THE CONTRARY, since there is no instant method of verification of the ID card data against the individual holding it, the very fact that there is a wealth of data on the card will make it easier for me to withdraw cash from your ATM, and then slit the next passer by's throat, thus not only tying YOU in with this crime, but creating a good alibi for myself, since MY ID card doesn't match the data left at the scene of the crime by YOUR card.

We will then be in the ludicrous situation, which happens today in courts up and down the land, where the absolutely MOST reliably form of ID verification, friends and family, are dismissed, ignored or worse still branded as liars and conspirators, for contradicting the Identity "EVIDENCE" which states that you were not at home with them, you were drawing money from an ATM 30 feet from the murder scence within 60 seconds of the murder.

This is a parallel with the "smashed mechanical analogue watch or timepiece" showing the time of death, or at least the time the person was struck by the car of fell from the roof, the modern more accurate with calculator bluetooth and god know what digital timepiece gives more information to the coroner, but ZERO USEFUL INFORMATION.

No, ID exists only for the same purposes as the original fingerprint checks, to tie a specific person to a specific place.

ID as a method of general identification is a whole different game, and the only systems that have EVER been accepted as having ANY worth are those that were based on the original public / private key verification / signing thing, and which still apply today if I want to sit a driving test in the UK and do NOT have one of the new photcoard driving licences, but an older no picture type, I must bring a photograph of me, SIGNED BY PEOPLE OF STANDING IN THE COMMUNITY (my doctor, local policeman, bank manager, etc) WHO K

Sounds Pretty High-Tech

[Compulawyer]

Especially for a country whose economy is based on the export of its most plentiful natural resource: Mud.

Oh, Estonia ... I was thinking Elbonia. Sorry - my bad.

I have Contactless ID cards too ...

[Gopal.V]

This is a magnetic card which needs to be moved about 1 1/2 inch in front of the reader . The magnetic card is topped by a Photo ID , so it the contactless means almost zero wear and tear of swiping.

All doors in the office open as soon as you flash the ID cards (the doors beep , and everyone looks up at you as if to say "what are you doing roaming around") ... being a card-puncher like this means they track my in and out timings (like when I leave my floor for lunch or stuff).

The entry into various rooms are restricted like this (this is an outsourcing company , so clients are very very paranoid about "nonfull disclosure" being maintained). Testing server room doors could with your ID could even get you fired here ..

It need not be RFID or anything magic - just extend the reader to something like the metal detector in an airport to read this magnetic ink (holding this against the noonday sun shows that these are lines/bar-codes running the whole length of the card like those security threads in currency)....

And I'm sitting here clocking the first 9 1/2 of the 47 1/2 hours needed for the week , commenting on slashdot :)