Microsoft Ponders UV Password Tattoos to Protect Pacemakers

In current medical devices that support so-called "distance telemetry," the implanted device is bonded with a base device using "proximal telemetry." Proximal telemetry works only at distances of a few centimeters or less and tends to be limited by the sensitivity of the receivers within the implanted devices. Only after the authentication and key exchange has occurred in the proximal mode is the distance mode activated, which then affords the users several meters of freedom.

The assumption is that a person who can stay close enough to the patient for the length of time required for the devices to bond is implicitly worthy of access. This is the same assumption that has served the industry well for the past few decades, although before the distance devices, the entire session would be conducted in proximal mode.

The bigger risk, as I see it, is that an attacker could successfully impersonate an already-bonded device. In that situation, neither proximal bonding nor UV passwords would help.