<![CDATA[Consumerist: RFID]]> http://cache.gawker.com/assets/base/img/thumbs140x140/consumerist.com.png <![CDATA[Consumerist: RFID]]> http://consumerist.com/tag/rfid http://consumerist.com/tag/rfid <![CDATA[ 'Identity Theft-Proof' Wallet Blocks RFID, Goes In Front Pocket ]]> If you're concerned about your RFID-chipped credit cards being skimmed, you might want to consider shielding them. DIFRwear makes a wallet with the shielding already included, and now roguewallet in Maine has introduced its own RFID-shielded version, with a fin-shaped design so it fits better in your front pocket to thwart pickpockets. Unfortunately, it's also $50, compared to $20 for the more conventional looking DIFRwear hip-pocket design. (Both are FIPS 201 compliant, if that means anything to you.)

Or, if you want to go the really cash-conscious route, make your own.

roguewallet.com (Thanks to Wells!)

]]>
Consumerist-5051800 Thu, 18 Sep 2008 13:15:00 EDT Chris Walters http://consumerist.com/index.php?op=postcommentfeed&postId=5051800&view=rss&microfeed=true
<![CDATA[ Mythbusters Host Retracts RFID Censorship Comments ]]> Mythbusters host Adam Savage is retracting comments he made at a hackers conference where he said an episode exposing security flaws in credit card RFID technology was squelched by credit card company lawyers. In a new statement Adam says, " If I went into the detail of exactly why this story didn't get filmed, it's so bizarre and convoluted that no one would believe me, but suffice to say...the decision not to continue on with the RFID story was made by our production company, Beyond Productions, and had nothing to do with Discovery, or their ad sales department."

'MythBusters' co-host backpedals on RFID kerfuffle [Cnet] (Thanks to Dariush!)
PREVIOUSLY: Mythbusters Gagged: Credit Card Companies Kill Episode Exposing RFID Security Flaws

]]>
Consumerist-5045633 Thu, 04 Sep 2008 17:20:43 EDT Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=5045633&view=rss&microfeed=true
<![CDATA[ Mythbusters Gagged: Credit Card Companies Kill Episode Exposing RFID Security Flaws ]]> UPDATE: Mythbusters Host Retracts RFID Censorship Comments

Credit card companies successfully nixed a Mythbusters segment exposing RFID's security flaws, according to Arbiter of Truth and Mythbusters co-host, Adam Savage.

Despite increasingly widespread use in passports and credit cards, radio-frequency identification is notoriously insecure. Hackers have successfully hijacked RFID-enabled credit cards from almost 70-feet away. Mythbusters had arranged a conference call with Texas Instruments to explore a similarly depressing demonstration.

Texas Instruments comes on along with chief legal counsel for American Express, Visa, Discover, and everybody else... They were way, way outgunned and they absolutely made it really clear to Discovery that they were not going to air this episode talking about how hackable this stuff was, and Discovery backed way down being a large corporation that depends upon the revenue of the advertisers. Now it's on Discovery's radar and they won't let us go near it.

In related news, here's a post showing how to steal RFID credit card information with $8 worth of equipment from eBay.

Arphid Watch: Mythbusters and RFID [Wired via BoingBoing and Caveat Emptor]
(Photo: Getty)

]]>
Consumerist-5043831 Sat, 30 Aug 2008 13:30:40 EDT Carey http://consumerist.com/index.php?op=postcommentfeed&postId=5043831&view=rss&microfeed=true
<![CDATA[ Don't Want RFID On Your Plastic? Call Your Credit Card Company ]]> con_chaseblinkcard.jpg There's all sorts of advice online about how to disable RFID chips and tags, and now that they're starting to show up uninvited on credit cards, you might be tempted to try some of those tactics. But as a reader found out, many credit card issuers will simply swap out your newfangled RFID-enabled card for a traditional one if you just ask.

Stephen's card came from Wells Fargo, and he had no trouble getting it replaced:

To do this I called the "800" number on the back of my card. I had to identify myself to an automated system and request the automated system connect me with a banker. When connected with a real person I requested to have a card issues without the Pay Wave feature. Most phone bankers do not know what RFID is. It is best to refer to it by its retail name. The request was taken care of in less than 5 minutes. The current card I have is still valid if I wish to use it. When I receive the new one I can activate it and destroy the old one.
We know that Citibank is also willing to provide non-RFID cards upon request, and this blogger says so is Chase—so if you're not ready to embrace your RFID future, it's worth giving your card issuer a call.

(Thanks to Stephen!)

]]>
Consumerist-350908 Wed, 30 Jan 2008 20:59:36 EST Chris Walters http://consumerist.com/index.php?op=postcommentfeed&postId=350908&view=rss&microfeed=true
<![CDATA[ German Department Store Launches RFID-Enhanced Men's Department ]]> con_silverrfidtagonwood.jpg A German department store is trying a new RFID system in its men's department, where it's tagged 30,000 pieces with Smart Chip labels. When shoppers take garments into the dressing room, an integrated display shows the customer price, materials, and care instructions, as well as sizes and colors available. Later this year, the screens will also show complimentary pieces, a great help if you're not good at matching clothes or are color blind.

The parent company, METRO Group, already uses RFID along its supply chain and to improve warehouse management, and plans to use the front-of-store RFID tags to speed up inventory replenishment and to help employees locate products faster. Their press release says that "If the customer desires, the Smart Chip will be removed by employees once the product has been paid for." (Why would you ever leave an RFID tag on once you've bought the item?)

We're not among the anti-RFID crowd in retail applications like this, where it's used to better track inventory and match real world items to a database of related information. In fact, we'd like to see even more features built into something like this. For example, the ability to request alternative sizes or complementary pieces via touchscreen, so that you can hone in on the right garment without making multiple trips to the dressing rooms. Or to be able to save lists of clothes you like into a wish list or database that you can access online later.

"RFID gives new kind of shopping experience to Galeria Kaufhof customers" [fibre2fashion.com - warning: press release]
(Photo: Getty)

]]>
Consumerist-302588 Fri, 21 Sep 2007 17:41:51 EDT Chris Walters http://consumerist.com/index.php?op=postcommentfeed&postId=302588&view=rss&microfeed=true
<![CDATA[ Don't Like RFID In Your Credit Card? Ask 'Em To Turn It Off ]]> While the danger of someone long-distance slurping the account information communicating out the RFID chips being increasingly embedded in credit cards is, for the time being, remote, reader Eyebrows McGee reports success in asking AmEx to turn it off...

I told the representative that I didn't like RFID as a consumer or a citizen and I worried about the potential privacy issues and was it possible to get a card without RFID on it? She said what she could do for me was disable the RFID function at AmEx's end. (She did not actually answer me about whether non-RFID cards are available.) So I had her disable the ExpressPay function, which took about two minutes on hold (for which she apologized).
No word to as to whether this works for other companies. Hardware based solutions for the same include foil and Dremel.

PREVIOUSLY:
No-Swipe Credit Cards Pose Risk Says Senator
Long-Distance RFID Snagging Possible, Already Done
No-Swipe Credit Card No Problem For Thieves

]]>
Consumerist-298734 Tue, 11 Sep 2007 14:54:22 EDT Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=298734&view=rss&microfeed=true
<![CDATA[ How To De-RFID Your Credit Card ]]> Credit card companies are putting magical radio chips inside your credit cards to allow for "touch n go" "contact-less" payments, but if for some reason the idea of a miniature beacon transmitting your credit card information, albeit however encrypted the companies feel like making them, there is something you can do about, blogs Cody: Dremel!

1. Google your specfic credit card name and type (i.e. Chase Freedom Card) + RFID. If you get some hits of people saying there's an RFID chip inside, it's probably got one.
2. Hold your credit card up into the light and see if you can spot the raised bump. That's the RFID chip.
3. Drill a hole in the spot.
4. Voila! You're off the grid.

As long as you don't make huge gashes and tear through your magnetic strip, this should in no way affect your ability to swipe at the store or use ATMs.

How To De-RFID Your Credit Card [adr.enal.in]

]]>
Consumerist-289478 Tue, 14 Aug 2007 16:42:00 EDT Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=289478&view=rss&microfeed=true
<![CDATA[ Protect Your RFID Credit Card With A RF Jammer ]]> Credit card companies are embedding radio frequency tags (RFID) in credit cards. Since these are transmitters, there's the possibility of a thief using an RFID sniffer to snag your credit card digits.

Independent researches demonstrated this type of security hole in RFID credit cards back in October.

The credit card companies are eager to expand use of RFID and it will take something going wrong first before they implement stronger security. Until then, consumers have to defend themselves.

One way is to use a RF jammer to block all RF signals around you. Only turn it off when you want to do a transaction.

Lady Ada has a nifty tutorial of making one, assuming you have advanced soldering and circuit bending skills. Barring that, Google yields readymade results. P.S. RF jammers are illegal, see FCC statue inside.

Another way to protect yourself is to not use a credit card with a RFID chip inside, but how long before we don't have a choice? — BEN POPKEN

Wave Bubble [Lady Ada via BoingBoing]

UPDATE: This might be a little harder than we thought. We asked Lady Ada if an RF jammer could in fact be used in this way. She says, "it can, however there are multiple RFID frequencies so youd have to pick out VCOs to match."

RF jammers are illegal in the US and subject to FCC fine.

(m) Harmful interference. Any emission, radiation or induction that endangers the functioning of a radio navigation service or of other safety services or seriously degrades, obstructs or repeatedly interrupts a radiocommunications service operating in accordance with this Chapter.

Which includes:

(p) Kit. Any number of electronic parts, usually provided with a schematic diagram or printed circuit board, which, when assembled in accordance with instructions, results in a device subject to the regulations in this Part, even if additional parts of any type are required to complete assembly.

Furthermore

The operation of transmitters designed to jam or block wireless communications is a violation of the Communications Act of 1934, as amended ("Act"). See 47 U.S.C. Sections 301, 302a, 333. The Act prohibits any person from willfully or maliciously interfering with the radio communications of any station licensed or authorized under the Act or operated by the U.S. government. 47 U.S.C. Section 333. The manufacture, importation, sale or offer for sale, including advertising, of devices designed to block or jam wireless transmissions is prohibited. 47 U.S.C. Section 302a(b). Parties in violation of these provisions may be subject to the penalties set out in 47 U.S.C. Sections 501-510. Fines for a first offense can range as high as $11,000 for each violation or imprisonment for up to one year, and the device used may also be seized and forfeited to the U.S. government. (FCC website)

]]>
Consumerist-229631 Thu, 18 Jan 2007 11:19:09 EST Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=229631&view=rss&microfeed=true
<![CDATA[ HOW TO: Disable RFID in Your New Passport ]]> passportattack.gifDespite the fact that RFID chips are not secure and can be read by hackers, any U.S. Passport issued after Jan 1 will contain an RFID chip. If you'd like to risk 25 years in prison for tampering with it, Wired has a primer on how to disable the chip and protect yourself from ID theft.

The basic idea? Don't try washing it or microwaving it. Hit the chip with a hammer. —MEGHANN MARCO

How To: Disable Your Passport's RFID Chip [Wired via Gizmodo]

]]>
Consumerist-224601 Wed, 27 Dec 2006 15:26:54 EST Meg Marco http://consumerist.com/index.php?op=postcommentfeed&postId=224601&view=rss&microfeed=true
<![CDATA[ Personal RFID Firewall Invented ]]> This paper outlines a system for protecting yourself from the threat of RFID bandits snagging the credit card information you broadcast. The "RFID Guardian" jams your RFID signals, then it clones their signals and rebroadcasts them only if and when you tell it. If the banks won't make the cards more secure, it's up to the user to protect himself. — BEN POPKEN

Personal firewall for the RFIDs you carry [BoingBoing]

]]>
Consumerist-219909 Wed, 06 Dec 2006 17:41:13 EST Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=219909&view=rss&microfeed=true
<![CDATA[ No-Swipe Credit Cards Pose Risk Says Senator ]]> Credit cards that use RFID signals to conduct transactions could put consumers at risk for identity theft and credit card fraud, Sen. Charles Schumer, D-NY said in a press conference Sunday.

Schumer said thieves can use radio frequency readers to steal the credit card information.

"All you need to be is within a couple of feet of the customer," Schumer said. "You may as well put your credit card information on a big sign on your back."

Don't worry, a thief would actually have to have a reader nearly touching your credit card to steal it. This is completely impossible, which is why no one has been able to invent pickpocketing. — BEN POPKEN

Consumers warned about no-swipe credit cards [AP]

Previously:
No-Swipe Credit Card No Problem For Thieves
Foil RFID Thieves. Literally.
Long-Distance RFID Snagging Possible, Already Done

]]>
Consumerist-219251 Mon, 04 Dec 2006 23:13:42 EST Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=219251&view=rss&microfeed=true
<![CDATA[ NYC RFID Subway Turnstiles Spread ]]>

New RFID turnstiles mean Citibank customers with enabled cards or credit wands need never fumble for a Metrocard again.

Reader C-side spotted this one at at the Broadway/Lafayette subway station in Manhattan.

Eventually, RFID will spread to ever every transaction point. They're already at McDonald's. Forward-thinking churches will use RFID collection plates.

Good thing the security of broadcasting one's credit card information via transponder is completely worked out... — BEN POPKEN

Another picture, inside.

http://www.consumerist.com/assets/resources/2006/11/subrfid2-thumb.jpg

]]>
Consumerist-214531 Mon, 13 Nov 2006 22:19:06 EST Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=214531&view=rss&microfeed=true
<![CDATA[ RFID Confuses The US Government ]]>

Despite a report by Homeland security, the US is going ahead with plans to put RFID tags in everything from passports to drivers licenses.

"The Data Privacy and Integrity Advisory Committee of the DHS concludes that RFID chips are useful in inventory management but aren't suitable for human identification, where privacy issues remain a concern."

"RFID appears to offer little benefit when compared to the consequences it brings for privacy and data integrity. Instead, it increases risks to personal privacy and security, with no commensurate benefit for performance or national security," the report states."

Well, that seems pretty fucking clear. Will the government listen to itself? Who the hell knows. Maybe they should have put the report into an RFID, where more people are likely to read it.

]]>
Consumerist-212132 Fri, 03 Nov 2006 13:50:42 EST Meg Marco http://consumerist.com/index.php?op=postcommentfeed&postId=212132&view=rss&microfeed=true
<![CDATA[ Long-Distance RFID Snagging Possible, Already Done ]]> After posting about the danger posed by magic wand credit cards, some readers pooh-poohed the notion that someone could build a device capable of reading RFID from a distance.

For the benefit of readers not scouring the comments, let us point you to this item from the summer of 2005. A SoCal group twenty-year-olds at DefCon 13, an annual gathering of security analysts and hackers, "...set the world record for transmitting data to and from a "passive" radio frequency identification (RFID) card — covering a distance of more than 69 feet." [Washington Post]

Here's some more cool pictures of the device they made.

The security vulnerability exists. Just because it's hard, doesn't mean someone won't find a way to exploit it. There's money to be made.

After all, it's kinda difficult to make a fake ATM card reader and slip it on top of an ATM machine and harvest credit card numbers, right? Or decrypt PINs mistakenly stored at checkout counters? Or slip a hand inside your pocket and steal your wallet?

]]>
Consumerist-209611 Mon, 23 Oct 2006 20:22:15 EDT Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=209611&view=rss&microfeed=true
<![CDATA[ Foil RFID Thieves. Literally. ]]> The tin-foil hat contingent may have finally hit on something right.

There's a simple solution to the threat of thieves stealing no-swipe credit cards.

A BoingBoing reader sayeth, "The radio signal can be easily blocked with as little as a sheet of tinfoil or the anti-static material (like what an EZ-Pass ships in.) Putting a bit of foil or anti-static material between your card and the outside of your wallet will block potential ID thieves."

You could even take it a step further and make a whole anti-RFID wallet.

This is all thanks to the relatively weak power of RFID tags, the transmitor broadcasts the credit card information. It still won't prevent the CIA from mind-raping you.

Previously: No-Swipe Credit Card No Problem For Thieves

]]>
Consumerist-209602 Mon, 23 Oct 2006 19:50:07 EDT Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=209602&view=rss&microfeed=true
<![CDATA[ No-Swipe Credit Card No Problem For Thieves ]]> Radio-frequency enabled credit cards allow consumers to complete transactions with a flick of the wrist, but new research shows that it's not just consumers and merchants who will find the new system easier.

Thieves, equipped with a device about the size of a pack of gum and costing less than $50 in readily available electronic parts, can intercept the credit cards.

Equipped with such a device, a fraudster could walk through a crowd of people, harvesting cards into a portable reader. An unauthorized reader could be placed behind a legitimate reader and transmit the numbers back to the thieves' lair. Or a reader could be embedded in an innocuous-looking package and placed in mailboxes, culling and transmitting numbers on newly issued credit cards.

Until these security vulnerabilities are addressed, hold off on getting a credit card wand. Their most breath-taking magic may be how swiftly they're used to rack up a mountain of jewels, embossed leather jackets, and spinning hubcaps, all in your good name.

"Researchers See Privacy Pitfalls in No-Swipe Credit Cards" [NYT]
Vulnerabilities in First-Generation RFID-enabled Credit Cards (pdf)
RFID Payment Card Vulnerabilities Technical Report (pdf)

]]>
Consumerist-209419 Mon, 23 Oct 2006 11:01:41 EDT Ben Popken http://consumerist.com/index.php?op=postcommentfeed&postId=209419&view=rss&microfeed=true
<![CDATA[ RFIDs Cloned Within Human Flesh ]]> Man%20with%20barcode%20on%20forehead.jpgIf it means I have to memorize one less arbitrary pin code in my life, you can tattoo a bar code on my forehead as far as I'm concerned. Still, many are worried about the privacy issues involved in implanted RFID chips, and the prospect of living in a society that may make them mandatory. Big Brother and all that.

Luckily, the damn things are worthless for unique identification purposes. Annalee Newitz and Jonathan Westhues successfully cloned a VeriChip tag implanted in human flesh, live on stage in front of an audience. So heck, if Big Brother ever does come down to forcing a microchip into every meaty American flank, take comfort in the notion that you could easily reprogram yourself to be Washington the Sweathog, if you so desired.

High-tech Cloning [Reuters]

]]>
Consumerist-189881 Wed, 26 Jul 2006 04:59:02 EDT consumerist.com http://consumerist.com/index.php?op=postcommentfeed&postId=189881&view=rss&microfeed=true
<![CDATA[ Ohio Employees Have a Chip On Their Forearm ]]> verichip.jpgMost people don't mind wearing a security badge to work, but CityWatcher.com's new employee identity verification system may be the first of its kind: RFID microchip implants. The Cincinnati-based video surveillance firm has "chipped" a couple of its employees, implanting glass-encased RFID transmitters in their forearms. The chips act much like current RFID badging technologies, granting the chipped employees access to restricted areas—the main difference seems to be that a determined thief would have to cut the chip out of the employee instead of simply making off with their badge. Makes the $10 badge replacement fee pale in comparison, we think.

Only about 70 people in the United States have been implanted with microchips, and of those virtually all have been (ostensibly) for medical reasons. Depending on the brand of crazy you subscribe to, you might think this is just another mind control method, or even that it is the infamous mark of the beast. The more rational of us realize that there's good and bad in any technology and, like everything else, a judgement can only be made after we see how it is used. As a replacement for easily lost or stolen pieces of plastic that grant access to sensitive areas, this tech could be a winner. As a national ID that ties into our bank and credit accounts and is required for any kind of commerce, well, we're neither deeply religious nor hexakosioihexekontahexaphobic, but count us out.

US group implants electronic tags in workers [Financial Times via Smart Mobs]

]]>
Consumerist-154453 Mon, 13 Feb 2006 12:02:20 EST rashmore http://consumerist.com/index.php?op=postcommentfeed&postId=154453&view=rss&microfeed=true
<![CDATA[ How Wal-Mart Consumes Countries ]]> MSN Money has a more objective business-oriented look at Wal-Mart's sprawling empire of consumerism, weighing both pros and cons of their practices. Of course, this being the Consumerist and Wal-Mart being our favorite corporate antichrist figure [which does not, we note, prevent us from worshiping them. -Ed.], we're going to blockquote part of the con:
Most important, Wal-Mart is exporting a retailing and supply-chain system that trains and influences not only the "associates" but the public as well. People in these many countries become Wal-Mart customers. They will live with the results of Wal-Mart's (and Procter & Gamble's (PG, news, msgs)) commitment to radio-frequency identification (RFID). The technology sneaks into the store on cat s feet.

The power of Wal-Mart is partly derived from its partnerships and its bold use of technology. These two things in combination give them the muscle to knock out much of the competition, for better or worse, regardless of state or nation. Retail Forward, the market research firm, has predicted that Wal-Mart will top $500 billion by 2010. That will translate into more power and more countries.

The question is, what is this going to change, and how will the world and its customers adapt themselves to a Wal-Mart world?

Goodbye mom-and-pop stores, goodbye local stores in local places. Hello to stores that have a favored position in their procurement processes and their overall supply-chain practice. Hello to efficient store-owned distribution centers.

It's an interesting look at how Wal-Mart actually inserts itself as a significant presence into entirely new territories and the ramnifications it has on those countries' consumer cultures, both good and bad. Plenty of ammo for both sides of the debate here.

]]>
Consumerist-150409 Tue, 24 Jan 2006 13:44:01 EST consumerist.com http://consumerist.com/index.php?op=postcommentfeed&postId=150409&view=rss&microfeed=true