RFID-Blocking Blazer and Jeans Could Stop Wireless Identity Theft

An anonymous reader writes A pair of trousers and blazer have been developed by San Francisco-based clothing company Betabrand and anti-virus group Norton that are able to prevent identity theft by blocking wireless signals. The READY Active Jeans and the Work-It Blazer contain RFID-blocking fabric within the pockets' lining designed to prevent hacking through radio frequency identification (RFID) signals emitted from e-passports and contactless payment card chips. According to the clothing brand, this form of hacking is an increasing threat, with "more than 10 million identities digitally pick pocketed every year [and] 70% of all credit cards vulnerable to such attacks by 2015."

Comments

signal blocking

[frovingslosh]

If you build radio signal blocking into all of your pockets, doesn't that also screw up your cell phone from getting a call? And wouldn't it muck with my keyless entry system on my car where I just carry the fob in my pocket and the car will know when it is me trying to get in or start it?

Re: signal blocking

[Anonymous Coward]

Agreed. I have a Samsonute wallet with rfid blocking material. It works nicely, and it doesn't mess with my cellphone.

Re:signal blocking

[codeButcher]

If you build radio signal blocking into all of your pockets, doesn't that also screw up your cell phone from getting a call?

And the downside is?

Re:signal blocking

[Anonymous Coward]

If you build radio signal blocking into all of your pockets, doesn't that also screw up your cell phone from getting a call?

Yes and no.

If the signal blocking is wide-band it will screw up your cell phone. It will probably increase signal strength to get through and drain the batteries more than necessary.
The thing is that RFID typically works on the comparably low frequencies 125 kHz and 13 MHz while cell phones works higher up on 800 MHz and above.
That means that you can create a grid that blocks the lower frequencies while letting the higher frequencies through.

Re:signal blocking

[Z00L00K]

If the wireless cards don't have ample protection against copying of information and forging then the platform design is flawed.

A correctly designed public key infrastructure solution would be a lot harder to crack. Cards shall only reveal sensitive information to authorized readers, readers verify that the cards aren't forged.

The only thing left is the human factor.

Re:signal blocking

[rvw]

If you build radio signal blocking into all of your pockets, doesn't that also screw up your cell phone from getting a call?

And the downside is?

Phone getting hot and battery drowned.

Re:signal blocking

[jrumney]

The wireless cards have ample protection against copying of the complete information to make clones. RFID Passports have sufficient protection against someone being able to get useful personal data without seeing the same info on the inside of the passport first. EMV cards however will cough up all the information from the front of the card unencrypted (or if not, encrypted using a fixed publically known key at least) to anyone within range.

Re: signal blocking

[Anonymous Coward]

The weight of carrying a phone and expense of buying it when you didn't want to get any calls in the first place.

Re:signal blocking

[AmiMoJo]

There is no need for payment cards to ever reveal any information that can be used for identity theft, except for the card number. That on its own isn't much use.

All you need for a transaction is the card number and a challenge/response to confirm that the card is the one it claims to be.

Re:signal blocking

[gstoddart]

If the wireless cards don't have ample protection against copying of information and forging then the platform design is flawed.

Of course it's flawed. It's been flawed since it was introduced. This was introduced by credit/debit companies to make it more convenient so people would use it more so they'd collect more fees.

The first time I saw one I thought it was dangerous and idiotic. I largely still do because it's un-authenticated. Sadly, pretty much every card comes with it now.

When will people understand ... companies who create these products don't give a damn about security, they care about getting people to use shiny new baubles. Security comes much later after it's been hacked.

We know all this. We discuss it every time this topic comes up. It's well traveled stuff around here.

But, dude, you're missing the big picture here ... freakin' tinfoil pants. How awesome is that? I mean, now we can have an entire fashion line of tinfoil clothing so we can go out and look normal.

That styling cap I'm wearing? Yeah, it looks like a hipster fashion statement, 'cuz that's how I roll. Inside? Tinfoil hat bitches.

No more strange looks when I go grocery shopping. Now, all of your paranoid needs can be met while still remaining fashionable and discrete ... which has the added benefit of remaining inconspicuous so they Aliens don't even notice you.

Hmmm ... what's that van parked outside my house for?

Re: signal blocking

[TheCarp]

I have a friend who is just flabbergasted at the idea that I sometimes just turn my ringer off and don't take calls.

I like to be able to take calls or to make them when I want to. I like having a mobile gps device and all that.... um, I like having a phone, but sometimes, I don't want to be disturbed, and sometimes Iforget to turn that off for a day or two...oops... but I can still call out and thats what I pay the bill for.....

Re:signal blocking

[Ol Olsoc]

If you build radio signal blocking into all of your pockets, doesn't that also screw up your cell phone from getting a call? And wouldn't it muck with my keyless entry system on my car where I just carry the fob in my pocket and the car will know when it is me trying to get in or start it?

First off, yer not carrying that phone right. Both hands on the phone held out in front of you, head and eyes down, checking your facebook page. Style points for walking into traffic.

But seriously, if you are wearing a Faraday cage, rf signals will be blocked. In addition, when in that state, the phone will be trying to "phone home to report it's position at it's highest available power, so will drain the batteries quickly.

But to me, it just seems like a better idea is a Faraday wallet. Because if you are concerned about things like this, are you going to have to wear this outfit's clothing all the time?

Re: signal blocking

[Ol Olsoc]

I have a friend who is just flabbergasted at the idea that I sometimes just turn my ringer off and don't take calls.

I've seen people freak when in areas with no coverage. "What if someone tries to call or text me?"

Smartphones are as addictive as meth.

Re:signal blocking

[Ol Olsoc]

The thing is that RFID typically works on the comparably low frequencies 125 kHz and 13 MHz while cell phones works higher up on 800 MHz and above.That means that you can create a grid that blocks the lower frequencies while letting the higher frequencies through.

True, although it shouldn't matter in this case, because the spacing of the grid which controls the highest frequency blocked, means that on clothing, it's going to have to be pretty close. It's related to how Cell phones will work in Cars, because of those holes in teh metal cage of the car.

It's possible to build a cage that will block lower frequencies but not cell frequencies, like my car example, but the reverse is not true. For human sized clothing, I'd wager that they just have closely spaced metal cloth woven into it that will block almost everything.

I'll bet they have some special non cagey pockets for the cell phones.

Re:signal blocking

[Ol Olsoc]

If the wireless cards don't have ample protection against copying of information and forging then the platform design is flawed.

Of course it is. When they design these things, security is last on the list.

Re: signal blocking

[Darinbob]

Maybe I'm confused by the story, but what has RFID in it? I thought these new currency things used NFC which is normally able to be turned off.

Re:signal blocking

[cthulhu11]

Plus you'd become the sort of douchebag who wears a blazer and trousers instead of a jacket and pants. No thanks.

while you are at it

[ruir]

Why not trousers+condoms all built-in...this has to be the more stupid informercial I have seen here for a while.

Re:while you are at it

[tehcyder]

Why not trousers+condoms all built-in...this has to be the more stupid informercial I have seen here for a while.

This is slashdot, advertising condoms here would be like targeting the Taliban with whisky ads.

Re:while you are at it

[Charliemopps]

Neckbeards having sex with drunken Muslim fundamentalists?
I think you might be on to something...

Re:while you are at it

[Anonymous Coward]

Not whisky. The Taliban drink tharra

Brilliant idea

[Hognoxious]

People will replace all their clothes, rather than buying one tinfoil case/pouch per device. Makes total sense.

Re: Brilliant idea

[Anonymous Coward]

It's developed by Norton, of course it will be bloatwear.

Re:Brilliant idea

[datavirtue]

This is one of those things that seem like a good idea until the CEO learns about it in a press release. Norton...WTF?!

Tinfoil hat

[broknstrngz]

For full garment

why not just carry around a portable EMP generator

[Karmashock]

That's what I do.

Hope it works better then my wallet

[Skylinux]

Paid extra for an RFID blocking wallet. Tested it out the next time I had to pay for lunch with my RFID card.
Placed wallet on reader, card is somewhere in the middle, beeep, thanks for you payment - fuck.

My wallet is a "Protact" with the A written like a German AE. 100% rip off, hope these pants are better.

Re:Hope it works better then my wallet

[Dr_Barnowl]

I found the el-cheapo cardboard sleeves with a foil lining to be entirely adequate. 5 in a pack for a few dollars. I've not replaced the first one yet (I only have one NFC capable credit card).

Re:Hope it works better then my wallet

[AmiMoJo]

The solution is to make the cards secure. So far there have been no known contractless payment thefts via "walk by" attack, so it seems like the security works. I've been using such cards for a decade now without issue so at this point I trust them.

It's things like passports that are more at risk, since an attacker can read some personal data from them (payment cards are either anonymous or don't provide things like your name, they only allow transactions). Fortunately I don't carry my passport most of the time.

Re:Hope it works better then my wallet

[Anonymous Coward]

Place your credit card against a dolphin torch and turn it on. You'll see a dark outline inside the edge of the card. This is the antenna.

Take a stanley knife, cut out a 4mm wide section across the entire antenna. Once you cut deep enough, you'll find wire tracks. Cut out an entire section of the antenna, making sure you get all the windings in that section (In my card it wrapped around the edge 4 times).

Put a dab of superglue over the square you just cut out to stop the card from delaminating.

The RFID on your card no longer works!

Re:Hope it works better then my wallet

[Anonymous Coward]

I bought a wallet branded as "Traveler". Works like a charm. Put my RFID security card inside, couldn't get into the office without taking the card out.

Re:Hope it works better then my wallet

[ColdWetDog]

Passports are easy. Just microwave the thing. Fries the chip but looks normal. "I don't know why it doesn't work,officer."

Re:Hope it works better then my wallet

[fahrbot-bot]

Passports are easy. Just microwave the thing. Fries the chip but looks normal. "I don't know why it doesn't work,officer."

Got my passport in 2006, don't think it has RFID. My VISA card does - or did until I centered a hole punch over the chip and whacked it with a hammer. That was strangely satisfying :-)

Re:Hope it works better then my wallet

[LessThanObvious]

I don't know why we persist with such horrible security for an unnecessary convenience. If you have to wrap your card in foil or use a stainless steel wallet or buy special clothes, isn't the convenience lost at that point?

Re:Hope it works better then my wallet

[rdnetto]

Got my passport in 2006, don't think it has RFID. My VISA card does - or did until I centered a hole punch over the chip and whacked it with a hammer. That was strangely satisfying :-)

I really don't understand this logic. Yes, wireless connections to the card are a risk (and I say that as someone who took measures to shield my wallet), but that risk is minuscule in comparison to the risks associated with using the magstripe (vulnerable to skimming) instead of the chip (uses challenge and response).
These days, if someone requires me to use magstripe, I look at the terminal extremely carefully before swiping.

Re:Hope it works better then my wallet

[fahrbot-bot]

Yes, wireless connections to the card are a risk ... but that risk is minuscule in comparison to the risks associated with using the magstripe (vulnerable to skimming) instead of the chip (uses challenge and response). These days, if someone requires me to use magstripe, I look at the terminal extremely carefully before swiping.

The VISA Pay Wave doesn't have user challenge/response, it's simply a wireless magstripe. It's just a gimmick and really no faster than swiping the card. Skimming at a POS terminal - other than at a gas station or older ATM - is pretty rare (and/or ballsy) and I've personally never heard/read about it anywhere. I live in the US, so your mileage may vary elsewhere...

Re:Hope it works better then my wallet

[rdnetto]

The VISA Pay Wave doesn't have user challenge/response, it's simply a wireless magstripe.

Do you have a citation for that? It seems odd to me that they would use such a weak mechanism, when the existing chip already uses challenge/response.
The standard used is ISO/IEC 14443, which enables half-duplex communications, suggesting that challenge/response is at least plausible.

Additionally, in my country (Australia), I found that when they introduced PIN-less transactions for contact less cards below a certain threshold ($100), PINs were no longer required when the chip was inserted, which is consistent with my belief that the RFID mechanism is just another means of connecting to the chip.

Re:Hope it works better then my wallet

[fahrbot-bot]

The VISA Pay Wave doesn't have user challenge/response, it's simply a wireless magstripe.

Do you have a citation for that?

Sure, every TV commercial showing someone using Pay Wave - tap, (beep/flash), done. In addition, it's advertised as being faster than just swiping. Having to type in a PIN isn't faster. The US is supposed to move to Chip and PIN next year for CC - I think debit cards usually need a PIN already (not sure, I would *never* use a debit card). Often no signature/PIN is required for common purchases (like food) if under $50 - both CC and debit.

Re:Hope it works better then my wallet

[rdnetto]

Ah, I think you misunderstood me. When I said that it uses challenge-response, I was referring to the cryptographic challenge-response (e.g. the card receives a message, signs it with a private key, then transmits the signature), in contrast to magstripe, where data is simply read from the stripe.

Calling it fraud could stop identity theft

[khchung]

You know what could completely stop identity theft? Holding banks responsible for the loss when they were tricked by some thief pretending to their customers. You will see them tightening their authentication and fraud detection overnight.

You know why some countries don't have any identity theft at all? They held banks and companies responsible when they were defrauded, and won't let them pass the loss to their customers by claiming "identity theft".

Re:Calling it fraud could stop identity theft

[ArmoredDragon]

You know what could completely stop identity theft? Holding banks responsible for the loss when they were tricked by some thief pretending to their customers. You will see them tightening their authentication and fraud detection overnight.

This is how it already works in the USA. By law, customers can only be held liable for up to $50 for credit card fraud, and almost all banks just offer the courtesy of reducing the liability to zero (you have to be with an incredibly shitty one and/or have a VERY shitty credit rating for them to not do this.)

And if somebody steals your identity by taking out loans in your name, it's on the lender to prove that you were the one who actually took out the loan to begin with. It's inconvenient as hell granted because of all of the shit you have to go through to sort it out, but at the end of the day you don't have to pay anything to the banks if you're the victim, and the banks are the ones that lose.

Identity theft still happens anyways because whether the thief steals from you or the bank, they still make money out of the deal (unless they get caught.)

Re:Calling it fraud could stop identity theft

[drinkypoo]

And if somebody steals your identity by taking out loans in your name, it's on the lender to prove that you were the one who actually took out the loan to begin with. It's inconvenient as hell granted because of all of the shit you have to go through to sort it out

And that's why you're wrong. It's on YOU to prove that the loan is fraudulent. My identity was stolen by an illegal mexican who "bought" a car. Now that's on my record until I go to court and prove that it wasn't me.

Re:Calling it fraud could stop identity theft

[AmiMoJo]

That's the way it is in the UK. The banks still try to trick the victim into saying that they made some kind of mistake, or argue that a lack of up to date anti-virus on your PC makes you liable, or that their security is perfect so it simply must have been your fault. In the end though if you stick to your guns they have to pay up.

Re:Calling it fraud could stop identity theft

[anegg]

I agree that calling it fraud could stop identity theft, and I'm completely baffled why this hasn't happened in the United States already. The victim is the bank or the store, and if they don't want to be victims they should do a better job of proofing their customers. As long as its called "identity theft" and we continue to consider the person whose name was used the "victim" we won't see a change. As soon as courts start telling businesses that unless they have iron clad proof of identity they (the business) are the victim, we'll see the problem go away. Certain things will become much less convenient (like instant credit) but that seems to be a reasonable price (to me).

Re:Calling it fraud could stop identity theft

[Anonymous Coward]

i think you need to reread your parent. i think the lack of a subjunctive that threw me off on the first read.

"if a loan taken out by somebody else were automatically considered fraud, it would be up to the banks
to document that you made the loan."

i'm not sure if the reason cc transactions are covered in the way that they are is because fraud, though.

Re:Calling it fraud could stop identity theft

[Actually, I do RTFA]

You're both right, you're both wrong.

The burden is on the bank to force you, via the law, to repay them. The burden is on the person to clear their credit report of the issue.

Now, the desirability of having a large system that operates under "guilty until proven innocent" and, while not having the force of law, is still pretty vital to living in America.... well, that's a different story.

This doesn't solve the problem at all

[fuzzyf]

How about we stop using RFID to transfer important (identity theft type) data?

Re:This doesn't solve the problem at all

[Z00L00K]

Or at least use a properly designed PKI solution?

Re:This doesn't solve the problem at all

[stephanruby]

The RFID/NFC tag on your passport requires a lot of your private information already as the private key to decrypt it. And even then, the biggest additional piece of information at the first level of encryption it gives you is your picture (the same picture that's already in your passport).

Users with Android phones with NFC capabilities can check this for themselves.

Every time an official checks your passport, that digital picture is only used to verify that the physical picture on the passport hasn't been tampered with. In other words, this feature is used to prevent identity theft, not make it easier to do.

Re:This doesn't solve the problem at all

[AmiMoJo]

Do any cards actually have that kind of data available over wireless comms? Passports do, but most people don't carry them regularly. Bank cards and the like usually don't, they only supply the card number and a challenge/response mechanism. The card number alone isn't enough to make fraudulent transactions.

Re:This doesn't solve the problem at all

[fuzzyf]

It depends on the encryption being unbreakable. If it's possible to break the encryption you can get a passport-valid photo, fingerprints, social security id, and other personal identifiable information. It's a gold mine for identity thieves, and you only need to be close enough to read it. Just searching google gives a clear indication that the encryption is breakable.

It might make the Passport safer, but it's certainly not preventing identity theft.

So there is clothing...

[Plumpaquatsch]

So there is clothing that makes it easier to steal clothing by blocking the RFIDs of the theft detection systems?

Re:So there is clothing...

[austinpoet]

I wish I had mod points. This is the first thing I thought of. Except why bother to only steal more clothes?

Re:So there is clothing...

[OolimPhon]

So you don't think there are people who shoplift out of designer stores to resell?

Re:So there is clothing...

[austinpoet]

I meant, there are more things protected by RFID than just clothes. :P

Perfect! I combine it with my tinfoil hat

[prefec2]

Well great idea. First, I chip me, my clothes, my belongings, my accessories. And then I use a tinfoil jacket and trousers to block them all. Great idea. On a second thought. Such clothes are the perfect addition to my tinfoil hat. However, for complete protection I would recommend tinfoil underwear, socks, and - because this is slashdot - condoms to be absolutely safe.

It's by Norton...

[SeaFox]

When you're wearing the jeans your legs will only move at two-thirds normal speed. You have to have the blazer dry cleaned, and specifically by Norton, once a year otherwise it and the trousers may cease to function and leave you naked out on the street one day.

Re:It's by Norton...

[operagost]

You forgot to mention that a month before your trousers disappear, every 10 minutes they shout YOUR SUBSCRIPTION IS ABOUT TO EXPIRE and you have to slap your leg to get them to shut up.

"More than 10 million identities"?

[Anonymous Coward]

There was an article not so long ago where a national is card in south Korea was used as target. If I remember correctly that over 50% of the population suffers from identity theft.

NOT RFID!

[ramriot]

Every time this come up, its RFID ePassport this and RFID credit card that. None of these use RFID at all, the technology used is NFC. As for the RFID blocking jacked, pants, wallet etc. I have tried a number of these and yes they are good at blocking RFID access tags, but do only a little to reduce the range of NFC.

Re:NOT RFID!

[darqik7037]

This bugs me too. I have an "RFID" meeting in an hour or so to discuss an RTLS deployment using various RFID tags and RTLS transponders. The sales team has no interest in improving the management's understanding of what they're buying, only pushing product.

Re:why not just carry around a portable EMP genera

[tehcyder]

That's what I do.

"And that's why I no longer fly anywhere..."

Here's an idea

[jenningsthecat]

Just stop with all the RFID bullshit on credit and debit cards! Really, is that extra few seconds taken to insert and enter a PIN such an onerous burden? People in that much of a hurry aren't likely to use that precious sliver of time to stop and smell the roses anyway.

For those worried about cell phones and the like, I suspect the new-style duds will do little or nothing to impede those signals. They're a couple of orders of magnitude higher in frequency than the current RFID payment systems, and they use far-field RF, whose intensity falls off with with the square of distance. The intensity of Near-Field Communications falls off with the cube of distance, and is more 'magnetic' than 'electro' in nature, so the shielding mechanism tends to be different.

For myself, I plan on de-activating all of my contactless payment cards by breaking the antenna loop with a drill, as soon as I can get them imaged so I know where the antenna traces are. I've already had my banks disable the feature, so in theory I shouldn't be able to make contactless payments, but that won't stop info theft via unauthorized readers.

And yes, I DO wear my tinfoil hat proudly...

solution in search of a problem?

[alphad0g]

None of my credit cards are RFID. The only cards I have ever had that are RFID/NFC are hotel keys, and conference cards. My passport cover itself blocks RFID scanning - US passports only work if open.

And of course the sensationalism of the quote "more than 10 million identities digitally pick pocketed every year [and] 70% of all credit cards vulnerable to such attacks by 2015" - really? There are many problems with statements like this - but I am sure the Marketing group came up with them:

- stealing a credit number and maybe name is not an identity
- 10 million is a big number - every year since when? So 20% of the US has been compromised in the last few years?
- credit cards are being issued with chip and pin - RFID credit cards will become obsolete

The same people that buy these pants should buy shirts and hats that protect them from Unicorns and other fictional creatures.

Re:why not just carry around a portable EMP genera

[AmiMoJo]

I wear a nylon sweater to build up some static charge. Zaps any RFID readers that try to steal my identity in a brush-up attack. I don't half go through a lot of phones though.

Do they have hats too?

[140Mandak262Jamuna]

Especially ones lined with Original Reynolds(tm) material? They will have a huge market.

Back pockets not secure

[Alain Williams]

keeping a wallet in a back pocket is a silly thing to do anyway - easy for (physical) pick pockets to lift stuff from there.

Where to find a good RFID blocking wallet

[rvw]

I would like to buy a simple RFID blocking wallet. I can find a lot of them on Amazon, but none seem to have a coin compartment. I currently use a Lifeventure wallet, and I would like to get something similar. Ideally it would have the outside blocked, the inside not. So when you open it, you would be able to hold the card to an RFID scanner, without having to take it out.

All suggestions are welcome!

Re:The downside is?

[Technician]

TSA search at the airport

Columbia makes RFID blocking wallets

[Burz]

They have both bifold and trifold. Don't know how well they work, though.

Re:For those who didn't read

[Technician]

It is only the pockets that are protected. Good luck getting that pair of jeans in your pocket.

Are you only planning on stealing ladies underwear?

"Going equipped"

[Martin Spamer]

Until you get charged with "Going equipped for stealing" an offence under the Theft Act. Since blocking RFID will block most shop security devices. Perhaps Blazers will become the new uniform for shop lifters.

As fashion statements go ...

[Rambo Tribble]

... this hardly has the cachet of tinfoil.

REquest the right card

[CimmerianX]

You know you can request Credit cards and IDs without the RFID chip in it. I do this all the time with Visa and AMEX. I request cards without the Chip.... problem solved.

Laugh

[koan]

Stupid idea, instead just make wallets, phone sleeves or other small item carriers with the lining.

I'll wait for SP1 ...

[CaptainDork]

... I'm not an early adopter.

It's fixing the wrong thing

[dingleberrie]

If the card companies are depending on the cardholder's pants for improving security, then their system is broken.