Slashdot Mirror
Researchers Find Problems With RFID Passport Cards
An anonymous reader writes "Researchers at the University of Washington have found that RFID tags used in two new types of border-crossing documents in the US are vulnerable to snooping and copying. The information in these tags could be copied on to another, off-the-shelf tag, which might be used to impersonate the legitimate holder of the card." You can also read the summary of the researchers' report.
Bear shits in woods, news at 11.
FTFA:
We show that a key anti-cloning feature proposed by the U.S. Department of Homeland Security (the tag-unique TID) remains undeployed in these cards.
Did they compare the efficiency of copying passports w/ and w/out RFID?
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
Already been done.
Finally had enough. Come see us over at https://soylentnews.org/
So, if I want to be Elvis all I need is one of those new passports.
Cool.
Love many, trust a few, do harm to none.
Please, someone in authority with intelligence tell me what to think about this. Oh.. wait... that's never going to happen is it.
I guess this is especially bad, considering their security!
This is about the umpteenth time we hear about this. Somehow, I can't believe anymore that putting these chips in passports was meant to increase security. The question is...what _was_ the purpose?
Please correct me if I got my facts wrong.
Part of creating a more authoritarian society is to keep your populace under fear. To have the more knowledgeable elements of your population know just how close they are to losing their freedom due to a modern equivalent of a filing error is entirely intentional.
No-one in government/civil service wants these documents to be 100% secure. A few accidental misidentifications will keep everyone realising how powerless they are, and a few "accidental" misidentifications will be used to conveniently eliminate specific undesirables.
Summary: If you fear that your identity will be stolen now, the government is operating as intended.
Too expensive cheaper here.
A moulding nail works great for smashing the hell out of just the RFID chip. My new AmEx came with one and I immediately crushed the hell out of it. I was thinking about doing the same to my new passport when it arrives. I decided that the plausible deniability might be a little slim for a precisely placed hole over the chip though. Perhaps another destructive method might be in order. Who knows what might happen if I accidentaly stood too close to a strong microwave emitter... I hear that the microwave oven is good for drying out wet passports too.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
Oh yeah. Nothing to worry about. One of the main stated reasons they started introducing these things was to facilitate entry to Great Britain. I've never been to Europe, have no planned trips there for maybe the rest of my life. Wonderful.
Another danger is that the tags can be read from as far as 150 feet away in some situations, so criminals could read them without being detected.
s/criminals/kidnappers/ which IS an issue in places I travel. Those RFID thingies shout out, "I'm an American citizen, kidnap me!".
Although the tags don't contain personal information, they could be used to track a person's movements through ongoing surveillance, they said.
See previous comment.
Though there's no reason for panic, "Our hearts should start to beat a little faster," Kohno said.
Bwahahahaha. Can I please have my paper only passport back, please? It's for my safety and think of my children.
Comment removed based on user account deletion
It's hard to find a large group of people more cynical than slashdot users.
If anything I'd say this proves that the cynical tend to be correct.
It will be considered a mangled document. Never mind that it's also an old style passport, if the RFID tag is broken then it's considered the same as if the passport was dipped in ink or burned too badly to read.
The fun starts when you consider that RFID tags break if exposed to too stong a signal of the kind used in RFID scanners. You could build one fairly easily, stick it in your backpack and hang out or even walk through somewhere with a lot of tourists.
Really?! Because I thought here in the UK, one of the main stated reasons they started introducing RFID passports was to facilitate entry to the United States!
Damn it, now I have to take off my tinfoil hat and use the tinfoil to protect my RFID!
One of the main stated reasons they started introducing these things was to facilitate entry to Great Britain.
Actually, much of Europe. But talk to your government about that - they started the tit-for-tat escalating entry requirements. When someone enters the US now, they are photographed and fingerprinted, and the only reason I didn't require a biometric passport for entry last time I went was because there was a temporary visa waiver program in place for people without biometric passports.
Most of the stupid entry requirements for Americans entering other countries are due to politicians responding to pressure from their constituents complaining about being treated like criminals when they enter the USA.
I am TheRaven on Soylent News
I could see why you'd want to do this to other people's passports, but why do it to your own? Do you enjoy being detained by airport security before/after a long flight? Do you think the American government will pay to replace your defective passport?
I think the whole point is that (omitting the mangled document thing from the other reply) it prevents anyone else from reading/stealing/monitoring your data and hopefully would just be manually read and you would be on your way.
Support the EFF and Creative Commons. The war is coming, and they're supporting you...
Are you ready for the inevitable conspiracy theory? Here it is, cooked up between my wife and myself after discussing the implications of renewing our passports shortly.
The problems are actually a feature. Let me explain. Remember how the old Soviet-bloc countries didn't like their nationals traveling because they would see how much better the rest of the world was? (Don't get me wrong, I like it here just fine.) Well, if everyone who hears about this says "I guess I won't be traveling any time soon", it effectively stops travel (usually by the intelligentia) all the while allowing the govt to say "We have no travel restrictions on our own citizens".
Of course, all this is nonsense. Our current administration would never feign incompetence to obtain other goals. Yet there's plenty of other information that suggests there's no tom-foolery about this and that the incompetence is real.
So in short, I'm not sure which it is, but the bottom line for me is that I'm waiting until the last minute in the hopes that some of the recommended features are implemented by then.
Even if you do a convincing forgery of the card itself, you run a risk of discovery. Using the RFID data as an index into the government database, the border agent's computer system will pull up the photo (or other biometric data) of the genuine cardholder. If they are paying attention, they will see that you are not the right person, and bust you for forgery.
Also, each RFID passport card comes with a foil-lined sleeve that protects it from both physical damage and RFID skimming. I always keep mine in the sleeve when not in use. If others do the same, this vulnerability will be restricted to places where the cards are used, i.e., border crossings. Lurking around border crossings to clone RFID data seems like another risky strategy.
Someone call the Mythbusters! Oh, someone did? Darn.
My web domain.
Stop with the paranoia. You'll find people around the world are generally all decent people. Of course, YMMV in Iraq, Afghanistan, The White House, etc, etc
There, fixed that for you.
http://www.travel.state.gov/visa/temp/without/without_1990.html
You also realize that the US required these 27 countries to comply with their intent to implement RFID enabled passports, right? Should they decide NOT to implement the passports, they faced possibly losing their visa-free status.
"...requirements under the US Visa Waiver Programme which calls for countries to roll out their Biometric Passport before 26 October 2006."
http://www.wired.com/politics/security/news/2005/05/67418?currentPage=all
It will be considered a mangled document. Never mind that it's also an old style passport, if the RFID tag is broken then it's considered the same as if the passport was dipped in ink or burned too badly to read.
Having a toasted RFID chip would be much like having a gunked up, but not deliberately defaced passport number. The OCR machines are notoriously bad at reading the data at the bottom of the document. A fried, but not obviously physically damaged chip would appear to the border offical as if the chip or the reader had malfunctioned. They would most likely simply input the data by hand and send you on your way. If you use a hole punch to remove the chip, it's a completely different story. Then it looks like you're up to no good. They key hear is to look innocent ;)
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
Most of the places I can think of that have a problem with kidnappers would be places like the Philippines where I seriously doubt the kidnap-for-ransom groups would have RFID readers powerful enough to scan a large group of people and locate you. Besides, they won't be looking for AMERICANS, they would be looking for anyone from a devloped nation because they might have money. Most of these places you would stick out like a sore thumb looking like a tourist anyway, so the RFID card isn't going to give you away anymore than your appearance likely does anyhow. So, I think this fear of 'kidnappers' is overblown.
"Microwave"