{"id":32,"date":"2008-01-13T23:31:00","date_gmt":"2008-01-13T22:31:00","guid":{"rendered":"http:\/\/www.tapper-ware.net\/blog\/?p=32"},"modified":"2010-07-11T12:04:39","modified_gmt":"2010-07-11T10:04:39","slug":"if-i-had-a-hammer-or-why-rfid-in-passports-is-a-really-bad-idea","status":"publish","type":"post","link":"https:\/\/www.tapper-ware.net\/blog\/if-i-had-a-hammer-or-why-rfid-in-passports-is-a-really-bad-idea\/","title":{"rendered":"If I had a Hammer OR Why RFID in passports is a really bad idea\u2026"},"content":{"rendered":"

First things first: I actually do have a hammer and I know how to use it when it’s time to get my new RFID-enabled passport. It’s a fairly easy method to disable this ugly tracking device.<\/p>\n

The more important question is why should I do it? Well there are a couple of reasons, so let’s make a list:<\/p>\n

Let’s start with the basic problems of any encrypted data:<\/p>\n

    \n
  1. I don’t want the state to identify me… sure they say the data is encrypted, but there was no way for officials to read it, then we wouldn’t have to carry it around… so the key is somewhere and let’s face it: If any part of our state has this key then it won’t take long until every single policestation or whatever has access to it.<\/li>\n
  2. I don’t want others to identify me … if the key is available somewhere, then it won’t take long until it leaks out.<\/li>\n<\/ol>\n

    \nBut are there other scenarios where the chip could reveal your presence. Even if the encryption was not compromised?
    \nHell yes. With RFID anybody can track you, even without the encryption key. This is by far the most interesting point. Lets assume for a moment that the data is stored 100% perecent secure and that the key is not available to anybody (I know, it’s difficult but let’s try). Then the chip is still sending out the encrypted data which may not be readable by itself, but it’s still a unique identifier. It says that person XY was last seen going to a bank, then going to a chemical supply firm and finally after a brief visit to Starbucks boarding a flight to Saudi Arabia (at least if there’s a RFID scanner at all these locations…. this probably isn’t the case now but it’s still a possiblity we’ll have to deal with). Maybe you can’t find out who person XY is, but you sure can find out what he’s been doing as XY has left the same digital fingerprint at all these locations. And if XY has used another identifier, let’s say a credit card, at at least two locations with an RFID scanner, we even know that this person is me.<\/p>\n

    Now this may all be very useful when trying to catch a criminal (eventhough it violates about every privacy law we’ve got), but this kind of information is available to anybody who can afford an RFID scanner. Let’s assume a group of stores agrees to exchange RFID information… not with any other authority, just among themselves. Sounds pretty harmless doesn’t it? But from this information alone, combined with the list of items bought while you were at the store and matched across multiple shopping sessions and some easy statistical analysis they’ll get something like this:<\/p>\n

    Usually around 1pm at store A, usually buys sweets, pizza, Coke and bathroom acessories. around 6pm either at store B or C. This is only a tiny bit of what they could derive but already they’d know where you live, where you work and what you buy, just like that.<\/p>\n

    And this would only be the “normal”, “marketing” way of analysing your data. Criminals are much more inventive…<\/p>\n

    I’m not asking you to do anything but think about it how your privacy gets a beating with RFID passports.<\/p>\n","protected":false},"excerpt":{"rendered":"

    First things first: I actually do have a hammer and I know how to use it when it’s time to get my new RFID-enabled passport. It’s a fairly easy method to disable this ugly tracking device. The more important question is why should I do it? Well there are a couple of reasons, so let’s … Continue reading If I had a Hammer OR Why RFID in passports is a really bad idea\u2026<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/posts\/32"}],"collection":[{"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/comments?post=32"}],"version-history":[{"count":1,"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/posts\/32\/revisions"}],"predecessor-version":[{"id":166,"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/posts\/32\/revisions\/166"}],"wp:attachment":[{"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/media?parent=32"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/categories?post=32"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tapper-ware.net\/blog\/wp-json\/wp\/v2\/tags?post=32"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}