Why chips in passports and ID cards are a stupid idea
economist.com
economist.com
However, why would one use RFID when you don't want the reading to be easy? There are plenty of technologies that require physical contact to transmit information (like mag strips or smart chips). If they want the passports to have to be inserted into a machine, they might as well use one of those technologies.
I'm all for RFID in its place. It's great for my subway pass so that I don't have to take it out of my wallet. Same for highway tolls where I don't have to stop. But neither of those are instances where I completely care about security. Sure, I don't want anyone cloning my subway pass, but it also isn't a window into my identity like my passport is and so I can choose convenience a bit over security there. Oh, a good example would be something like site passwords. Sure, I don't want anyone getting into my HN account, but it's not quite the same as someone getting into my bank account and, as such, I don't need quite as complex a password for it.
I'm not saying that I like the idea of chips in passports, but if you're going to put one in, why RFID? Why on earth didn't they choose something that requires physical contact to be read? I mean, the article focuses on the RFID problems (that it can be read without you knowing it since it doesn't require physical contact) and doesn't explain how on earth RFID became the choice. While one might not want to have a chip on their passport, at least a chip that needed physical access to read would put the holder (mostly^) in control of who got access to that information.
^I say mostly because there are always pick pockets and such that could swipe it without your knowledge, but that's a much lower risk than someone walking around with an RFID skimmer - it requires the person to physically remove it from your person, put it in a reader, and return it to you without you or anyone else noticing; not impossible, but a great deal less trivial.
As long as the technology is not cheap enough to (profitably!) slap an RFID chip on every 25 cent cup of yoghurt, it won't be ready for retail.
(At least that's the picture in Germany. But thanks to Aldi, Lidl and a few others --- most of our groceries don't even accept credit cards, because their razor-thin margins make them unable to swallow the fee. Debit card processing --- which is mostly free for the shop --- is nearly universal however. (Except for Restaurants; most accept only cash.))
You can also pay with PIN if you want. That makes it post to your bank account quicker, which is nice if you keep track of your online banking.
In most parts of Europe, you also don't have to pay %15-20 on top of every meal at a restaurant out of obligation. Tips really are only tips, you leave one based on the service you receive.
For the life of me, I really can't get over the fact that you have to leave a 15% tip by default in the US (unless there was something blatantly wrong with your meal, of course). I mean, I'm not a dick, I still do it, I just can't get accustomed to it.
Getting back on topic (slighty) - I've had about $200 in cash in my pocket for the last couple months - I don't recall the last time I've been somewhere that I didn't use my Credit Card. Makes tracking my expenses via Mint.com a heckuva lot more straightforward.
> The official range of an e-passport’s RFID is supposed to be no more than ten centimetres (four inches). But with $100 worth of hobbyist gear, Israeli researchers managed to skim encrypted data off e-passports from several feet away. A student at Cambridge University in Britain went further, intercepting e-passport transmissions some 50 metres (160 feet) away.
> That was enough for State Department officials in Washington, DC, to insist that American e-passports be fitted with metal sleeves to shield them, when closed, from prying electronic eyes. The measures seem to be reasonably effective, though e-passports that get wedged open slightly by keys or loose change can still be read electronically from a distance.
> Slightly open passports could leave holders vulnerable to physical attack. Each country encrypts data in a characteristic way that terrorists could use to identify the nationality of the person carrying the chipped passport. To demonstrate the point, a firm called Flexilis used a partially opened American e-passport tucked in the pocket of a dummy to trigger an explosion as it passed a dustbin containing a small charge.
So I don't really see what all this scrutiny about identity documents is about. Identity is something that constantly changes, and doesn't really mean anything.
The 9/11 hijackers had valid passports and visas.
But adding a PUF is not expensive. For example the last option listed on the wikipedia link: a random magnetic strip costs fractions of a penny.
2.) RFID is not the problem, you can easily put a mesh inside the cover of the passport to prevent reading of the chip.
3.) Hammer time^Wthem. http://www.wired.com/wired/archive/15.01/start.html?pg=9 or tinfoil it.
4.) Subway cards with RFID are scary. In the UK the police uses the "named" cards to track peoples movement.