State Department Admits RFID Passports Are Insecure
The State Department is advising travelers using super-secure RFID-enabled passports to buy a "radio-opaque" holster, because it turns out that RFID chips aren't so super-secure after all. Don't fret if "radio-opaque sheath" isn't on your holiday shopping list, this is thankfully one of those rare problems that you can solve with a hammer...
Give the back of your passport a few good whacks and hope the feds don't give you 25 years for tampering with a passport.
The State Department asserts that hackers won't find any practical use for data skimmed from RFID chips embedded in the cards, but "if you don't want the cards read, put them in an attenuation sleeve," says John Brennan, a senior policy adviser at the Office of Consular Affairs.Gigi Zenk, a spokeswoman for the Washington state Department of Licensing, says the envelope her state offers with the enhanced driver's license "ensures that nothing can scan it at all."
But that wasn't what researchers from the University of Washington and RSA Laboratories, a data security company in Bedford, Mass., found last year while testing the data security of the cards.
The PASS card "is readable under certain circumstances in a crumpled sleeve," though not in a well maintained sleeve, the researchers wrote in a report.
Another test on the enhanced driver's license demonstrated that even when the sleeve was in pristine condition, a clandestine reader could skim data from the license at a distance of a half yard.
Well well, State Department, here's a sad little communiqué you never expected from the internet: we told you so.
Special alloy sleeves urged to block hackers? [AP via Upgrade: Travel Better]
PREVIOUSLY: HOW TO: Disable RFID in Your New Passport
(Photo: Ryan McFarland)
Post a comment
Comments:
I love the way the State Department claims that hackers will find no "practical use" for the data on the chip. Then why put one on there?
I'm wondering can you microwave the RFID passport/ID card and zap the chip without damage the appearance of the passport/ID card?
(I KNOW you can kill the RFID chip effectively this way. And if you do it right the chip won't really burst into flame. I'm more concern about the passport itself. If it is printed with sort of ink containing enough metal particles, microwave it can be a very very bad idea...)
In Soviet America, government identity thefts you!
@Bob Lu: I've heard it doesn't work very well. The hammer idea, when employed cautiously, will fix you right up with no obvious damage.
I would suggest putting something over said passport like a small piece of leather or flannel cloth before you smash it. It should still have the force to destroy the chip without leaving a hammer indentation or marks on the paper.
What really makes me annoyed is that people have been pointing out the huge flaws in this idea since it was conceived. The government just sticks their fingers in their ears and ignores it until they can't any longer.
Wasn't there some tech trick of making a folder out of duct tape and tin foil to block the chip?
@Steve Pan: Oh! So sorry! That was MY black helicopter flying over your house. I'll call it over right away. Sorry for the inconvenience!
This is one of the things that annoys me about government. All this talk about "radio-opaque sheaths" and "attenuation sleeves" to fix a problem they created. Not accounting for all the money spent to develop and test such things...
Aluminum foil and duct tape. It'll block almost anything.
@Steve Pan: Can't wake up... your government hasn't allowed the trade of my coffee rations over the border to Canada yet.
@Steve Pan: Umm, this started BEFORE Obama was in office and I don't think a Pres would be that involed in such a thing as passport tech. That said the policies of the Obama admin that have been implemented make me cringe...
looking at mine with careful bending of the back, it appears to be in the upper right quadrant, less than an inch from the top and maybe an inch from the binding. there is a small rectangle there that highlights and is slightly more resistant to bending. It also appears on my wife's, which is in better condition (less international travel).
Despite the fact that there were studies held (some from other countries that already embedded RFID chips in their passports) stating that the RFID signal could be easily read with a cheap RFID reader from a fairly long distance AND the "encryption" could be easily cracked, the U.S. Government did what it does best... make a token adjustment and disclaim anyone that would question the security of the entire outfit.
It really doesn't take a genius to realize that the protective covers will be useless for anyone that travels more than once during the 5/10 year expiry date (Anybody try reading a paperback book? After a while, the cover will begin to "float"). Not to mention that longer keys will eventually be crackable (in a relatively short amount of time, as technology progresses pretty rapidly).
@ospreyguy: That's exactly what I was going to say. Talk of implementing this has been around for many years, and I think they started allowing people to get the RFID passports a year or two ago.
But hey, since Obama's in office, everything that federal, state, and local governments do is automatically socialist...
@supercereal: It's either Socialist or completely fine (even when it's the exact same thing the last administration did), depending on your political slant.
federal and state officials recommend that Americans keep their e-passports tightly shut
So it sounds as if the passport cover has radio-opaque material on it, but passport cards and enhanced drivers licenses don't have such covers.
In other words, you don't need to buy a radio-opaque cover for your passport. Just for your enhanced drivers license or passport card.
@TCama: The cover of the e-passport booklet contains a metallic sheathing that can diminish the distances radio waves travel
Answered my own question just by reading more.
@CrazyTrain: They put it on there because it is useful to border security agents and the like durrp. Now whether or not the info is actually useless to criminals I'm not so sure of. Does anyone know what kind of info they hold. I'm guessing its just the information printed on it: address, name, etc. All of which are much easier to determine than by running around an airport with a scanner. Maybe they could do something with your passport number, but that's not exactly a credit card or social security number.
Wasn't it the Communists behind the Iron Curtain who spied on their own citizens and disregarded their own laws at their convenience?
No, wait, that was Bush-Cheney!
Seriously folks, pulling out the Socialist (Marxist, Leninist, whatever) card, is one of the weakest strategies of the Opposition. It just shows the lack direction after Bush-Cheney showed that they really stood for whatever they wanted, and not for a Party, Nation, or ideology.
If only the government listened - just every once in a while, not all the time; I'm a realist - to those filthy, hippy geeks who say, Privacy Is Good.
Even from government's "snazzy" ideas, or private companies' "innovation", or quasi-public utility/telecommunication entities' helpful monitoring "for our own good".
Even, filthy, hippy, geeky, bloggistas. Because the funny thing is that, sooner or later, we find that we're all filthy, hippy, geeky, bloggistas.
@Steve Pan: Highly political comments such as this should be banned in the Consumerist Comments Code and disemvoweled.
@supercereal: I was "allowed" to get one about a year ago. And by "allowed" I mean forced because there is no other option.
Stop! Hammer time!
Can't touch my data, hackers!
@TCama: Haha - it makes it sound like the RFID is like one of those obnoxious greeting cards - you open the passport up and the RFID signal come spilling out like the Batman theme song or something. If only it were that simple...
@CrazyTrain: It was my understanding (and I have no information that what I have read from the State Department when I received my passport) that the information on the RFID chip was identical to the information page of your passport which would make it more difficult to counterfeit or alter the passport information page. If this is true, the information on the RFID chip is your name, the state and country you were born in, your date of birth, your sex and a digital photograph.
When you go through Customs in the US, or in countries who have the RFID readers, they can "scan" your passport, and see a digital representation of the information that should be on the passport page. If this does not match, then you get additional screening.
@Nicole: I received my passport with RFID around the same time (June 2007). There was no "opt-out" method. George W. Bush was president, but I do not think he or Obama have anything to do with the implementation of RFID.
I'm sure a lot of the people who are concerned about RFID in their passports also have a similar transmitter in their credit cards which they've never thought about. If you do have one of these, you can call the bank to deactivate it.
@Rachacha: I don't see how this increases security at all. I'm sure most passports can be verified through a database, and those that can't probably have untrustworthy government-issued passports anyway.
@morlo: The printed surface of stolen passports can be overwritten by thieves to match their own info. This is used primarily to prevent that. The threat of being discovered is usually enough to discourage that method.
@catastrophegirl - sometimes makes typos and doesn't care: My God--Obama's Marxism/Socialism is so powerful it operates into the past!
@subtlefrog: Now I think passports should open up with theme songs and confetti. Wouldn't frontiers be more fun?
@floraposte: Haha, so true. Conspiracy theorists and extremists (left or right) can not be bothered with things like timelines and logic!
@Steve Pan: I know I shouldn't feed the troll, but how exactly does a private blog's code of conduct (that's been in place for years) have anything to do with Obama or ACORN?
How are you not banned for irrelevance, paranoia, and general douchebaggery yet?
@morlo: True if you are talking about a US Citizen at a US Boarder, but teh E-passport is a worlwide effort (ok, US, Canada, Europe and portions of Asia) to push a standardized passport to citizens. With an RFID reader, a boarder protection agent in Germany can verify that the passport is legitamite for a US Citizen, a Canadian Citizen or a Japaneese citizen and they do not need to be given access to the U.S. State department database as all of the information is contained in the passport.
@kduhtoe: You can call the bank to request a card that does not have the RFID in it. That may or may not be effective. I've never heard of a bank being able to "deactivate" the RFID chip in their customers' cards.
You can deactivate it yourself with a hammer, microwave or total removal.
@Julia789: I'm not 100% on this, but I think tin foil actually has the ability to amplify the signal while aluminum will block it. I kind of recall reading a study that came to that conclusion, but I'm too lazy to find it.
@Dn't tk nythng rn8301 sys srsly:
Ths s th srt f cnsrshp w cn lk fwrd t frm bm nd hs CRN lckys w nd t tk bck ths cntry
@Newvox: But Obama is continuing most of Bush's policies. Does that make him a Fascist too?
Fascist was the word you were looking for (or maybe Stalinist), Socialist and Marxist are economic theories. And I defy you to show me the party platform of any Socialist party in Europe and show me how it differs from that of the Democrats.
Yep. There's an RFID snooper from Russia in the Vienna airport right now with several missing teeth.