German Placing RFIDs in ID cards

[GGT]

Only because he said "whoever is responsible for your ID card". Implication being someone is looking out for our ID.

But so far, at least in the US, it hasn't been shown that ANYONE is really looking out for our ID cards, not even at this lowest level of technology, since there's so much identity theft.

[Flixy]

I call BS on any "pinpoint accuracy" of RFID chips. For one, I'm pretty sure that he didn't quite tell you how tracking baggage works. Hint: If you simply take the baggage of the track, tracking goes bye-bye.

Secondly, the range of passive RFID chips (of which we're talking here) is severely limited. And since an RFID chip has no sensors for velocity or position (that would be called "GPS" or something similar), you'd need pretty strong emitters (to overcome the range problem), and at least three of those in every room to allow for triangulation, because the walls would swallow the return signal again (well, you could up the signal strength again, but at that point you could probably also begin your own radio station with the emitters).

Which means, the "firemen in a house with mere chipcards" scenario is pretty unlikely.

You could see if somewent went through a specially-equipped door while wearing a decent ("not small") RFID tag. Locate the same person inside a room? Not so much. That's what this thing called a "camera" is for (and frankly, does a better job of it).

Agreed, RFID doesn't seem suitable at all with the firemen thing, passive anyway. And with tracking luggage is basically works like a slightly more reliable barcode (since barcodes can be obscured, resulting in lost luggage).

If we're worried about range, why not use some kind of QR barcode that reads an encrypted code or string of data that can only be read by specialized devices?

In theory the hacking risk is the same, but the technology is cheaper and info can't be stolen by over-the-air devices.

As for the practical issues, I don't see why increasing people's dependence on a single piece of identification helps protect privacy. Information should be divulged voluntarily and in exchange for specific services, not as a general-access pass for commercial goods.

I don't think a barcode could store enough information, really. A contact chip (like in the better credit cards and debit cards) seems like a better idea.

Anyway, AFAIK the entire idea of the type of RFID chip I have on my passport, is that it stores exactly the same information as the pass itself. But if it is stolen, a photo can be edited, birthdays and names can be edited, but since the correct information is still on the chip they can't use it at places where they are scanned. In that sense, they are safer than RFID-less passes. The difference is that while the card is harder to forge, it is easier to steal the information on it (which over here is basically name, DOB and personal number (like SSN). All this information already exists and is presumably a lot easier to steal this information in other ways than this way. Fortunately, this information alone is (at least over here) not enough for identity theft, AFAIK.

Also, Rand, we have ID cards but they have a picture on it, so a thief couldn't use it. And the pass itself doesn't help you one single thing to get government services online or by phone, either.

[Crazy_Ivan80]

anglo-hysteria about ID-cards. Quaint. Beware of that CCTV behind you, mind.

[Hazir]

anglo-hysteria about ID-cards. Quaint. Beware of that CCTV behind you, mind.

Yeah, that's real funny, they are totally hysterical about ID-cards but not about the the near total CCTV coverage of their country.

[wiggin]

Anyway, AFAIK the entire idea of the type of RFID chip I have on my passport, is that it stores exactly the same information as the pass itself. But if it is stolen, a photo can be edited, birthdays and names can be edited, but since the correct information is still on the chip they can't use it at places where they are scanned. In that sense, they are safer than RFID-less passes. The difference is that while the card is harder to forge, it is easier to steal the information on it (which over here is basically name, DOB and personal number (like SSN). All this information already exists and is presumably a lot easier to steal this information in other ways than this way. Fortunately, this information alone is (at least over here) not enough for identity theft, AFAIK.

I've seen arguments that it actually makes cards easier to forge. The UK passport encryption on RFID chips was broken in about two days, which meant that an enterprising individual could scan the RFID information of a new passport in the mail without opening it and have a replica made that would seem completely authentic (and, for that matter, greatly enhance the ease of identity theft).

Also, Rand, we have ID cards but they have a picture on it, so a thief couldn't use it. And the pass itself doesn't help you one single thing to get government services online or by phone, either.

Pictures only help if they're checked against a central database - otherwise both the RFID encryption/data and the physical picture can be changed and no one would be the wiser. Thus, the chip is adding little actual security. Otherwise, all you're doing is making a fancier key but not checking if it fits the lock.

[EyeKhan]

Take a good look around your slice of the world folks. Its not going to be this way for very long. Nobody told me that when I was a kid. Anyone here remember when you could dial any random phone number and ask things like: "Is your refrigerator running? Well you better catch it!" and stay completely anonymous? Didn't think so. Thank god for old formerly-contemporary novels (I'm talking about you Laura Ingalls). Without them we'd forget everything. Or not. What difference does it make anyway?

[Khendraja'aro]

Take a good look around your slice of the world folks. Its not going to be this way for very long. Nobody told me that when I was a kid. Anyone here remember when you could dial any random phone number and ask things like: "Is your refrigerator running? Well you better catch it!" and stay completely anonymous? Didn't think so. Thank god for old formerly-contemporary novels (I'm talking about you Laura Ingalls). Without them we'd forget everything. Or not. What difference does it make anyway?

You still can stay completely anonymous when playing telephone pranks. "Supress caller ID". Done.

(okay, practically you could get the number even with supressed caller ID - but for that you'll have to pay ~4.50€ per day to the telephone company. Nobody does that unless you're getting several prank calls per day over a longer period of time. But that was possible even with the old system!)

[earthJoker]

EFTA + Switzerland

We are part of the EFTA but unfortunately not of the EEA.

I think a contact chip would be better. But in general I would like to have an ID card and a passport.

[Khendraja'aro]

We are part of the EFTA but unfortunately not of the EEA.

I think a contact chip would be better. But in general I would like to have an ID card and a passport.

A contact chip has one major problem, however: mechanical wear.

They should simply use ultra-short range antennas, coupled with a metal covering for everyone.

[Hazir]

We are part of the EFTA but unfortunately not of the EEA.

I think a contact chip would be better. But in general I would like to have an ID card and a passport.

Hehe, see? It's even too complicated for me to keep up

I have a pasport for travel outside of Europe and an ID card for European travel.

[Flixy]

A contact chip has one major problem, however: mechanical wear.

They should simply use ultra-short range antennas, coupled with a metal covering for everyone.

My bank passes last 5 years without problems, and I use those contact chips a lot more often.

[Khendraja'aro]

My bank passes last 5 years without problems, and I use those contact chips a lot more often.

[Flixy]

Alright, lets put it this way: bank cards don't break that often and are used FAR more often than passports. And if the cards break, it's usually tearing and not a chip failure, those almost always work. And our public transportation cards are known to get broken easily (more than 1% in the first year or so), and those are RFID.

[Aimless]

Hang on while I try to find a "Reasonable argument cat disagrees" pic

[Khendraja'aro]

Alright, lets put it this way: bank cards don't break that often and are used FAR more often than passports. And if the cards break, it's usually tearing and not a chip failure, those almost always work. And our public transportation cards are known to get broken easily (more than 1% in the first year or so), and those are RFID.

Well, I'm coming from the opposite side - worked almost two years as tech support for a German Pay-TV station (Sky, formerly known as Premiere), where we used cards with such a chip.

The first step in almost any situation was: "Please remove power from the receiver for 10 seconds to reboot it."
The second step was: "Please remove and reinsert the card."

Hang on while I try to find a "Reasonable argument cat disagrees" pic

Make your own! I did

[earthJoker]

Well, I'm coming from the opposite side - worked almost two years as tech support for a German Pay-TV station (Sky, formerly known as Premiere), where we used cards with such a chip.

The first step in almost any situation was: "Please remove power from the receiver for 10 seconds to reboot it."
The second step was: "Please remove and reinsert the card."

I have the same experience as Flixy. What you describe is probably more a problem of the reader. The are big differences there and those stupid Set-Top boxes are using cheap hardware. And unlike the TV you don't us your ID that often.

[Khendraja'aro]

I have the same experience as Flixy. What you describe is probably more a problem of the reader. The are big differences there and those stupid Set-Top boxes are using cheap hardware. And unlike the TV you don't us your ID that often.

Well, we had to replace the cards themselves more often than the receivers. And I think it's a comparable situation since those cards contained heavy crypto-algorithms.

[earthJoker]

Well, we had to replace the cards themselves more often than the receivers.

Of course, because it's cheaper. But if the reader would have been better in the first place, it would be more tolerant to the cards.

I hope you are speaking about one of those chips as well.


The crypto algorithm in those card is a typical private key public key one, optionally protected by a PIN. That can easily be implemented in a simple FPGA. But this is the same with the RFID. The contacts can be a problem, but so can the antenna.

[Khendraja'aro]

Yeah, but the antenna is inside the card where it's not subject to tear and wear, unlike an open access chip.

[earthJoker]

It can be destroyed by bending the card.

[Khendraja'aro]

It can be destroyed by bending the card.

That is true for the other kind as well. After all, it's not as if the golden plates you see are the whole of the chip...

[earthJoker]

No the chip is much smaller (I actually opened it once).

[Hazir]

Is it possible that the newer chips emit a stronger signal ? I noticed that the public transport card that I got 4 years ago virtually needs physical contact with the reader. Nowadays I see people swipe their wallet somewhere in front of the reader and their card gets read.

[Draco]

^^I guess we can assume that they do with progression of technology. This article describes them in good detail.

Only because he said "whoever is responsible for your ID card". Implication being someone is looking out for our ID.

But so far, at least in the US, it hasn't been shown that ANYONE is really looking out for our ID cards, not even at this lowest level of technology, since there's so much identity theft.

I guess i didn't word that properly. I meant, whoever issues the ID card, which in these cases seems to be the government? I'm sure they'd have some sort of service where you could call up, or even do it online, to have your card disabled, the way you can do it with credit cards. It does sound like they're (the government or whoever) is looking out for our ID though.

Not sure if someone already mentioned this, but imagine if the Germans had this technology some 70 years ago

[Steely Glint]

a passport is not only bigger, but the card is also cheaper than a passport

I don't see how a passport is cheaper than an card with RFID.

Identity theft also is a lot tougher if you need more than a person's information from letters sent to him by a bank.

It's really not if you're carrying something around with you that can be read wirelessly, and one universal identifying document is inherently more vulnerable to identity theft. You might get my account details from sniffing through letters from the bank, but not my national insurance number, passport number, driving license number, etc. Once you compromise these cards, you get the whole lot.

[Khendraja'aro]

I don't see how a passport is cheaper than an card with RFID.



It's really not if you're carrying something around with you that can be read wirelessly, and one universal identifying document is inherently more vulnerable to identity theft. You might get my account details from sniffing through letters from the bank, but not my national insurance number, passport number, driving license number, etc. Once you compromise these cards, you get the whole lot.

And where does it say that our ID contains all those numbers?

[Steely Glint]

That's what the UK proposal was going to have, along with various records on you, all protected by state-of-the-art uncrackable encryption. However, expressing concern about this is anglo-hysteria, apparently. I should really be more concerned about low resolution film from 200m away of me going into WH Smiths.

However, even if a card doesn't have those actual numbers stored on the chip or in a related database if it is a true universal ID card - and if it isn't, what's the point other than just being 'ze papers'? - then it is effectively the same thing; by compromising that one card you can then access all the services the owner has access to - bank accounts, social security, health care, whatever. This is inherently less secure than different identifying documents for different things.

[Khendraja'aro]

If the services you talk about have no other security than this card, then this would indeed be worrisome.

[Steely Glint]

Well, thank god identity theft isn't a problem and never happens because of this "other security".

[Hazir]

I don't see how a passport is cheaper than an card with RFID.

I said the card is cheaper than the passport and it is because it is.

It's really not if you're carrying something around with you that can be read wirelessly, and one universal identifying document is inherently more vulnerable to identity theft. You might get my account details from sniffing through letters from the bank, but not my national insurance number, passport number, driving license number, etc. Once you compromise these cards, you get the whole lot.

First of all our national insurance number doesn't have the role it appear to have in your ideas. Second, it's not so easy to fake a card that has a digitized picture on it twice, once visible and once not so visible. The ID card by the way is only a means of verification of identification. I don't know any service you could get with your ID-card alone besides banks who would have a copy of your ID-card on record.

By the way; good luck trying to remotely read my ID card I am aware of the (low) risk and I am not exposing myself to it.

AND; that anglo-hysteria about ID cards predates the RFID chip and the Big Brother Plans of the Brown administration by decades.