RFID Explained

SecurityFocus has a nice column summarizing the last year's worth of stories about RFID. Of course, you, diligent Slashdot reader, have read about many of these already. But for your slacker friends that need an RFID education in one easy-to-digest article, here you go.

Shielding RFID against security

[nhaze]

Anyone who has used an RFID-based security pass card knows that they are easily shielded. Placing your RFID-secured product in an discreetly shielded bag would render the product nonexistant from RFID-probing security. I hope store that use it to augment theft security don't get lazy and think its unbeatable.

Re:The Register

[pogle]

And if you look closely, and RTFA, its the same one as Security Focus. From the author's name, right down to the '©SecurityFocus.com' at the bottom of the article.

Re:Shielding RFID against security

[MosesJones]

True.. but if using smart shelves the store will know that the item has been removed from the shelf and now is no-longer in range of a scanner... this should cause an alert as that is not normal behaviour.

Most theft is internal so identifying patterns of behaviour could be an effective way of decreasing theft.

The RF elements are the hardest part of this as the power levels are so low, in the US its 4 watts max for the READER, and in Europe its .5 watts. When you consider that the passive tags use the power that the reader puts out you can imagine how sensitive to interference these things are.

Security Director at Unisys UK Speaks

[Hellvetica]

Be sure to read this interesting reply [securityfocus.com] to this story by a security director at Unisys UK.

RFID tags used to find stolen musical instruments

[rpiquepa]

You'll find the summary of this Business 2.0 [business2.com]'s story on Smart Mobs [smartmobs.com]. And on my blog, you can find two other stories about RFIDs, Bye-Bye Bar Codes? [weblogs.com] and The Eerie Possibilities of RFID Tags [weblogs.com].

Re:Concerns - answered in follow up to article

[jimkski]

I think one of the responders (Stefan Sokolowski) to the article did a good job of shedding a little more light on some of these concerns:

As a real security professional (i.e. one that does not go around screaming that the sky is falling) and as someone who has worked with RFID for the military and for civilian uses (mainly Post Offices) for over six years, I find your article makes a number of glaring omissions that would allow any sensible human being to make a rational judgement about this technology.

Omissions:

1) Range verses size. Very basic issue. The smaller it is, the closer you have to be to it to pick up the signal. For a small passive tag we are talking inches (3-4 feet max). In order to track something from 200 yards (maximum range currently in use), you need an active tag (i.e. with a battery) and it has to be the size of a beer mat. I think you would notice it in your jeans. The signal generator in this case is also a non-trivial device. It is the size on a lamp-post and weights in excuss of 30Kg. Hardly PDA attachment material.

2)Storage area on the device is tiny. For the small passive devices you are referring to the storage area is less than 1Kilobyte. Not much space for your medical records here.

3)The logic associated with the tyre scenario. The association of the vehicle number and the tyre would not be stored on the tag. There is no space, and Read/Write tags are much more expensive (and larger). Easy to overwrite also. So for your big brother is watching scenario, you would need to replace every lamp-post on every highway with a signal generator, have assess to the database that cross-references your vehicle ID with the tag ids, and be able to monitor all of the signal generators in real-time to see what was happening.

And all this just to find out where you are. Are you really that important? I think ringing your mobile would be easier.

There is also a problem with reading many tags at once. The current limit is around 200 tags per second for the best sensor. The tag will respond and continue to respond at regular intervals (sub-second usually but dependant on set-up). Because they are all talking at once on the same frequency, the sensor cannot distinguish and ignore tags in real-time. It may recieve many responses from the same tag, and there is no way to tell the tag to shut up. So imagine the situation across a busy highway.

Nope they aren't

[MosesJones]

1D barcodes store only a reference number that can be used to indicate WHAT TYPE the product is.

And EPC stored on a tag tells you exactly WHICH product it is, and from that you can map its whole supply chain if it is all connected.

If you'd said 2D and 3D barcodes you'd have been more accurate, but those still can only be read one at a time.

RF-ID tags can be read thousands at a time and identifiy exactly which items you are dealing with. It is definately different but not by definition something to be paranoid about.

Re:RFID explained

[swillden]

Can RFID tage be deactivated? Once the product is purchased, is the tag still active or can the store "kill" it?

Yes it can be killed. In fact, stores have a good reason to do so, since that way they can tell the difference between an item that has been purchased and one that has been stolen. (Unless the thief has a device to deactivate tags, of course, but casual shoplifters wouldn't).

Re:Mark of the beast?

[rjamestaylor]

I'm all for an embedded RFID, as long as I don't have to worship someone to get it (you need to include verse 15, too):

• 14 Because of the signs he was given power to do on behalf of the first beast, he deceived the inhabitants of the earth. He ordered them to set up an image in honor of the beast who was wounded by the sword and yet lived.
• 
  15 He was given power to give breath to the image of the first beast, so that it could speak and cause all who refused to worship the image to be killed.
  16 He also forced everyone, small and great, rich and poor, free and slave, to receive a mark on his right hand or on his forehead,
  17 so that no one could buy or sell unless he had the mark, which is the name of the beast or the number of his name.
  18 This calls for wisdom. If anyone has insight, let him calculate the number of the beast, for it is man's number. His number is 666.

Check out a great explanation [recoveryversion.org] of the beast [recoveryversion.org] and the number of the beast. Hint: it's a reference to Nero [recoveryversion.org] who was, was not, and will be [recoveryversion.org].

Re:Interesting technology

[TheCrazyFinn]

Except the tags could be in the cash.

Europe is already considering this.

Oh, and to the guy suggesting that stores will remove the tags, umm, no, they will be in the closthing and products, not on it.

Re:Interesting technology

[uberdave]

Um... The RFID devices are already being built into the products, not into the tags, but into the products themselves. Also, microwaving an RFID tag embedded in an article of clothing is a fire hazzard. Oh, and what do you do when the embedded RFID device is built into something that would be destroyed by microwaves, say an MP3 player?

Granted, RFID tagged items would be a boon to inventory systems. But it does create an potentially undesirable electronic trail (manufacturer->vendor->credit/debit card->person)

Re:Interesting technology

[elwinc]

My original message was modded down for being redundant, but most of your objections could have been answered by reading the original article. [securityfocus.com] There's a simple solution: the tags will be removed from the products you buy at the store, much like current devices are.
If you read the article you'd see be aware that Michelin, for example, plans to embed tags in every tire, and to associate the tags with your VIN. As the article says: "Do you really want your car's tires broadcasting your every move?" Again, if you read the article, you'd be aware that "The European Central Bank may embed RFID chips in the euro note. [com.com]" Get tagged cash from an ATM, and the bank knows which bills you're carrying. Spend it on a hammer, and there's enough RFID trail to identify who bought the hammer. If you were to read the article before flaming, you'd see it's not completely irrational at all.

Also, who's to say that there will be any connection between the id stored in the tag and your name?
there may not be a connection immediately. It may be made later (the same way HTML cookie information is collated). Like when you hand over your ticket and step on an airplane, or when your EZpass equipped car goes through a tollbooth. The data can be collected now, and the individual identified later. Like when the police come to your door to pick you up as a material witness.

Companies would have no reason to keep track, and they're the only ones who could get that information.
That's showing a distinct lack of imagination. Companies have a ton of incentive to keep track. For example, think of all the great marketing information you can gather. For example, maybe Gap sweatshirt buyers hang out at the mall food court. Good place to advertise specials. What brands of clothing show up at a baseball game, or a chick flick, or the tool dept. at Sears? This information is valuable, and as it becomes cheaper to collect, companies will want to.

Instead of spreading FUD, try promoting proper use and regulation of a new technology that could be very beneficial in a lot of areas.
I'd love to see your suggestions for regulations controlling the use of RFID information. And I'd love to see a bill about it introduced in Congress before it becomes a problem. But as we know from the spam situation, Congress usually waits for something to become a big problem before it's willing to limit the freedom of marketers.

I also think you should withdraw that comment about FUD. Everything I wrote follows from intentions or potential intentions announced by companies or other institutions and described in the original article.

Active v Passive...

[MosesJones]

Active tags have a long range, Passive tags have a short range. Its Legislation that limits readers to 4watts in the US and 0.5 in Europe, not to mention other elements that make UHF RF-ID not feasible in Europe (channel hoping can't be done).

The tags that Walmart will use will be passive as they cost alot less.

Re:Shielding RFID against security

[Svartalf]

Based on the research of the RFID org that is fighting this (and I can't find the link now but I got if from a recent RFID posting on /.) The range of RFID tags can be up to 40 feet.

This strongly depends on the tag type. Even passive tags can have a range of 75 or so yards depending on the design of the tag (RF backscatter tags have an incredible range for a passive device...), frequency used, and the sensitivity and noise rejection characteristics of the reader's RF subsystems. Most of the tollway pass tags are passive or battery boosted passive (The battery doesn't power the unit per se, but lowers the response time of the tag dramatically because it's in a sleep state instead of powered off.). In the case of the tags they're talking about putting in merchandise, the range is typically only about 10 or so feet max, usually more along the lines of 3 or less feet- because the antennas on the tags are electrically speaking, crippling small and they're not operating on backscatter principles, but rather a beacon re-transmitting on a different frequency or on the same one when the power is turned off on the reader's end. Advances in tech can only bring you so far in this game. They can't radiate/recieve too much power because the antenna just won't do it for them. Upping the power on the reader will do only so much for you because you hit the wall on the range possible for the antenna on the tag itself. 40 feet's pretty amazing and I'd like to see a merchandise tag that actually can swing that with the measly 2.5 cm or less dipole or meander antennas these tags typically have on them.