Page 1 of 3 123 LastLast
Results 1 to 30 of 74

Thread: German Placing RFIDs in ID cards

  1. #1

    Default German Placing RFIDs in ID cards

    The production of the RFID chips, an integral element of the new generation of German identity cards, has started after the government gave a 10 year contract to the chipmaker NXP in the Netherlands. Citizens will receive the mandatory new ID cards from the first of November.

    The new ID card will contain all personal data on the security chip that can be accessed over a wireless connection.

    The new card allows German authorities to identify people with speed and accuracy, the government said. These authorities include the police, customs and tax authorities and of course the local registration and passport granting authorities.

    German companies like Infineon and the Dutch NXP, which operates a large scale development and manufacturing base in Hamburg, Germany are global leaders in making RFID security chips. The new electronic ID card, which will gradually replace the old mandatory German ID cards, is one of the largest scale roll-outs of RFID cards with extended official and identification functionality.

    The card will also have extended functionality, including the ability to enable citizens to identify themselves in the internet by using the ID card with a reading device at home. After registering an online account bonded to the ID card, are able to do secure online shopping, downloading music and most importantly interact with government authorities online, for example.

    Biometric passports in a number of countries are equipped with RFID chips, containing a digital picture and fingerprints, and have been around for nearly 5 years after the United States required such passports for any person entering the country.

    There are some concerns that the use of RFID chips will pose a security or privacy risk, however.

    Early versions of the electronic passports, using RFID chips with a protocol called "basic access control" (BAC), where successfully hacked by university researchers and security experts.
    The German ID card is using the BAC protocol as well, but only for the basic data which is printed on the front of the card, the picture and the name. Other fields are protected by a stronger proprietary protocol.

    Illegal access to the stored data would be useful to create perfectly forged passports and for criminals to use hijacked identities for supposedly secure transactions online.

    The responsible German ministry, however, cites the many advantages of employing a RFID chip, such as a longer card lifetime, the option to connect them to other future devices like RFID-reading mobile phones, and saving cost by being compatible with the existing infrastructure for the RFID passports.
    Source

    Last time this subject came up I think we were talking about the British. Will anyone switch sides on the issue now that Germany is doing it? Let's find out! (or not; I can't actually remember who was on which side)

    RFIDs in national ID cards: Intolerable intrusion on privacy, or prudent security measure?

  2. #2
    Continued reading...

    In a recent NewsHour report on cybersecurity, we showed security expert Chris Paget, shown above, climbing on a 29th floor hotel balcony in Las Vegas to demonstrate how he could read radio frequency identification tags at "long distances." The RFID tags are embedded in various cards people carry such as access cards to a building or embedded in products at stores. Paget mounted powerful antennas on the balcony, and aimed them at the cards far below. He claimed that with enough power, he could read what was on the cards. And he warned that such cards, issued by the government and businesses, could help identify people and divulge other information about them.

    But the editor of a magazine that reports on the RFID industry, Mark Roberti, objected to our story, saying that Paget's presentation didn't show RFID in a true light. He said 30 to 40 million people carry RFID tags on their windshields to allow them to cross bridges, and more carry them in their wallets, and there is not a single example of anyone who had their privacy infringed because of the tags. Roberti says police have not documented a link between identity theft and RFID. And, he continued, even if someone could read the tags, they wouldn't get much information.

    Roberti is concerned that the media, and some book authors, automatically assume that RFID tags will divulge personal data that thieves or the government would like to have. Some critics of the technology, he says, are convinced (with no evidence) that there is a conspiracy by big business and big government to spy on people, and that just isn't true. It's impractical to track people using RFID, he alleges, and long distance reading of the tags is not feasible. Taken as a whole, Roberti asserts, the benefits of RFID tags -- to track merchandise and packages, and keep track of drugs and food -- far outweigh any downside.

    But Paget sticks by his guns. He says that since RFID usually works at only a few inches, the fact that he can read transponders from 200 feet is, in his estimation, "long distance." He thinks with better technology, they can be read at several miles, eventually. He also says that radar principles are used, and that radar is designed to give direction and range, so that tracking of a person is completely possible -- an allegation that Roberti disputes.

    Paget says that information on an RFID tag can be useful; the numbers that can be deciphered give away the state where the tag was issued, what type of card (credit card, social security, phone, etc.) it is. He claims that it is a start to build a database on a person. And finally, Paget says he's not anti-RFID, as Roberti claims. Rather, he is against abuses where RFID is used in identification documents. He says the trade group that the RFID Journal represents has taken issue with his work before.

    Paget refers those who want more information to his own presentations on his website.

    The NewsHour segment on cybersecurity did not -- as Mark Roberti agrees -- do a complete segment on RFID, but rather included it in a much longer story about hacking. We didn't delve into the controversy over the tags. So bringing the subject up for more debate here seems valuable, and I hope this discussion of RFID moves the issue along.

    And over the next few weeks, the NewsHour team will be reaching out for other perspectives on RFID technology. Let us know your questions and we'll try to find the answers.
    Video of the report at the link above.

    Interesting to compare the current take on RFID technology to how it was approached back in 2006.


    ---------------------------------------------

    My county is in the final stages of RFIDing every circulating and reference item in the public library system. The tags are far from cheap. The only information they program is the book's barcode, but that requires a seperate database that ties the barcode to the actual information on the book. The library system has always been paranoid about privacy, especially after 9/11 and the government started asking for borrowing and computer records. So we save as little as possible, (ie, we have no record of something being out once its returned). because of that, I've come to understand that the term RFID doesn't immediately mean privacy violation. Yet I'm also aware that it can be implemented poorly.
    Last edited by Ominous Gamer; 08-23-2010 at 06:00 PM.

  3. #3
    No, I'm sorry. It seems zat your papers are not in order Herr Wraithensteiner.
    When the sky above us fell
    We descended into hell
    Into kingdom come

  4. #4
    Let sleeping tigers lie Khendraja'aro's Avatar
    Join Date
    Jan 2010
    Location
    In the forests of the night
    Posts
    6,239
    I actually can't remember the last time I had to show my ID card.
    When the stars threw down their spears
    And watered heaven with their tears:
    Did he smile his work to see?
    Did he who made the lamb make thee?

  5. #5
    I oppose compulsory ID Card with the British and I oppose them for the Germans too.
    The card will also have extended functionality, including the ability to enable citizens to identify themselves in the internet by using the ID card with a reading device at home. After registering an online account bonded to the ID card, are able to do secure online shopping, downloading music and most importantly interact with government authorities online, for example.
    Sounds awful.

    So I have a card (which I have to have due to law) in my wallet and I lose my wallet. Next thing, not only can someone get my private details on that card but they can use that card to do secure online shopping and interact with government services etc in my name? Is that right?

  6. #6
    RandBlade, Would you be more comfortable with the chip embedded in your arm? ... at birth.

  7. #7

  8. #8
    But no one could steal it then (except back-alley surgeons .. or people with illegal scanners...), so half of your opposition to this is eliminated...

    Edit: anyway, why not? People have a different form of identification (DNA), anyway.. can't get away from that! What's the harm.. what could go wrong...

  9. #9
    Quote Originally Posted by Wraith View Post
    Source

    Last time this subject came up I think we were talking about the British. Will anyone switch sides on the issue now that Germany is doing it? Let's find out! (or not; I can't actually remember who was on which side)

    RFIDs in national ID cards: Intolerable intrusion on privacy, or prudent security measure?
    Privacy's over anyway. Why fight it? Hear that? Fat lady's singin'.

    EDIT: Why use a frackin' card anyway? They should embed the chip sub-dermally in the back of your right hand.

    Oh, Aggie caught that already . . .
    The Rules
    Copper- behave toward others to elicit treatment you would like (the manipulative rule)
    Gold- treat others how you would like them to treat you (the self regard rule)
    Platinum - treat others the way they would like to be treated (the PC rule)

  10. #10
    No, it should go straight under your scalp... along with a bar-code. :]

  11. #11
    Quote Originally Posted by agamemnus View Post
    No, it should go straight under your scalp... along with a bar-code. :]
    I suppose being and RFID tag, it doesn't have to be scanned so nobody would be going around bowing at store counters all the time. And on your head, you get better radio reception.
    The Rules
    Copper- behave toward others to elicit treatment you would like (the manipulative rule)
    Gold- treat others how you would like them to treat you (the self regard rule)
    Platinum - treat others the way they would like to be treated (the PC rule)

  12. #12
    Most RFID readers are still pretty low power and need near contact with the tag. Better to put it in your hand for the convenience of reader manufacturers and owners.

  13. #13
    Quote Originally Posted by Wraith View Post
    Most RFID readers are still pretty low power and need near contact with the tag. Better to put it in your hand for the convenience of reader manufacturers and our new overlords.
    Fixed!

    ...

    Mm, Starcraft.

  14. #14
    Senior Member
    Join Date
    Jan 2010
    Location
    Amsterdam/Istanbul
    Posts
    12,313
    I don't see the problem; I have 2 RFID cards that I use on a daily basis. One to access my office and one for public transport. When I don't actively use them the are put in a small metal cardholder which effectively makes it impossible for anybody to read them. I presume it would work the same for an ID card with RFID.

    Also don't understand the hysteria about ID-cards in the UK and US. The cards are easy for a lot of situations as has been proven by over decades of use. Inside the EFTA + Switzerland they also are valid as travel documents. Which means that unlike a Brit I don't need to carry a passport when I want to travel anywhere in the EFTA + Switzerland. Not even when I travel to the UK. The last time I was asked to show my ID-card is well over 5 years ago now.

    P.S. I just checked; both my ID card and passport have got and RFID, just like the US passport and the NY driver's license. Just to name a few. The rfids on my ID and passport contain the exact same information that is visible for a person looking at my card.
    Last edited by Hazir; 08-23-2010 at 09:35 PM.
    Congratulations America

  15. #15
    Also don't understand the hysteria about ID-
    cards in the UK and US.
    It's them being complusory that the hysteria is about, plus the huge database in the case of the UK, not the bits of plastic themselves.

    Which
    means that unlike a Brit I don't need to carry a
    passport when I want to travel anywhere in the
    EFTA + Switzerland.
    No, you just have to carry another piece of identification instead. How and why is this a major selling point?

  16. #16
    Yay! Now everyone will be able to know whether or not the Germans are home!!

    I wonder how safe this encryption is now and how safe it will be in ten years.



    I also wonder what the problems are with compulsory ID-cards. Like, is it the faint stench of the police state? Or are there other philosophical problems?
    "One day, we shall die. All the other days, we shall live."

  17. #17
    On this scale, I don't think encryption really matters much. Whatever encryption is used, the government's side of things has to be distributed widely enough that it's basically public. Encryption only really works if both intended participants can be trusted, and I don't think that's the case here.

  18. #18
    The tracking aspect of RFID is in full use today.

    A contractor I employed 6 years ago who became a good friend, had a side business in writing software for RFID tracking, monitoring, and statistical analysis. This became his full business, and the product took off. He is now a multi-millionnaire.

    The primary use for his software? Tracking prisoners locations within prisons. It works perfectly well, and his software is now in use in prisons in several countries in mainland Europe.

    The last time I caught up with him, he had branched out to the US where RFID was being trialled in several airports, for tracking baggage. He was also in touch with local councils in the UK for the Fire services. They had an interest in tagging Firemen with RFID when called out to emergencies. The exact location of every fireman in a dangerous building on fire can therefore be tracked and monitored.

    To have that kind of pinpoint-accurate tracking device being held in a mandatory card in my wallet as I go about my personal day-to-day business, with the future potential for detailed monitoring and analysis of my movements? No thanks.
    Quote Originally Posted by Steely Glint View Post
    It's actually the original French billion, which is bi-million, which is a million to the power of 2. We adopted the word, and then they changed it, presumably as revenge for Crecy and Agincourt, and then the treasonous Americans adopted the new French usage and spread it all over the world. And now we have to use it.

    And that's Why I'm Voting Leave.

  19. #19
    Let sleeping tigers lie Khendraja'aro's Avatar
    Join Date
    Jan 2010
    Location
    In the forests of the night
    Posts
    6,239
    Quote Originally Posted by Timbuk2 View Post
    The tracking aspect of RFID is in full use today.

    A contractor I employed 6 years ago who became a good friend, had a side business in writing software for RFID tracking, monitoring, and statistical analysis. This became his full business, and the product took off. He is now a multi-millionnaire.

    The primary use for his software? Tracking prisoners locations within prisons. It works perfectly well, and his software is now in use in prisons in several countries in mainland Europe.

    The last time I caught up with him, he had branched out to the US where RFID was being trialled in several airports, for tracking baggage. He was also in touch with local councils in the UK for the Fire services. They had an interest in tagging Firemen with RFID when called out to emergencies. The exact location of every fireman in a dangerous building on fire can therefore be tracked and monitored.

    To have that kind of pinpoint-accurate tracking device being held in a mandatory card in my wallet as I go about my personal day-to-day business, with the future potential for detailed monitoring and analysis of my movements? No thanks.
    I call BS on any "pinpoint accuracy" of RFID chips. For one, I'm pretty sure that he didn't quite tell you how tracking baggage works. Hint: If you simply take the baggage of the track, tracking goes bye-bye.

    Secondly, the range of passive RFID chips (of which we're talking here) is severely limited. And since an RFID chip has no sensors for velocity or position (that would be called "GPS" or something similar), you'd need pretty strong emitters (to overcome the range problem), and at least three of those in every room to allow for triangulation, because the walls would swallow the return signal again (well, you could up the signal strength again, but at that point you could probably also begin your own radio station with the emitters).

    Which means, the "firemen in a house with mere chipcards" scenario is pretty unlikely.

    You could see if somewent went through a specially-equipped door while wearing a decent ("not small") RFID tag. Locate the same person inside a room? Not so much. That's what this thing called a "camera" is for (and frankly, does a better job of it).
    When the stars threw down their spears
    And watered heaven with their tears:
    Did he smile his work to see?
    Did he who made the lamb make thee?

  20. #20
    Quote Originally Posted by Wraith View Post
    On this scale, I don't think encryption really matters much. Whatever encryption is used, the government's side of things has to be distributed widely enough that it's basically public. Encryption only really works if both intended participants can be trusted, and I don't think that's the case here.
    Exactly... it only takes 1 person in the entire government (ie: one person with a card reader) to break the "safety" of the encryption.

  21. #21
    If we're worried about range, why not use some kind of QR barcode that reads an encrypted code or string of data that can only be read by specialized devices?

    In theory the hacking risk is the same, but the technology is cheaper and info can't be stolen by over-the-air devices.

    As for the practical issues, I don't see why increasing people's dependence on a single piece of identification helps protect privacy. Information should be divulged voluntarily and in exchange for specific services, not as a general-access pass for commercial goods.

  22. #22
    I think the fundamental problem of RFID in many people's opinion is that divulging the information on the chip (whether in an ID card, a product in a store, a library book, whatever) is not a voluntary action, but can theoretically be done passively - and this information need not be more than the fact that the chip was in a specific place at a specific time (rather than any information contained on it). A similar but lesser concern revolves around the use of other passive surveillance techniques - CCTV (especially in places like Britain) et al. Furthermore, given the growing sophistication and size of databases and data-mining operations, storing and cross-referencing lots of RFID-related information could theoretically yield a lot of information about an individual and their habits - information which is probably a breach of privacy. Obviously, the current technology is fairly limited in range and scope, but given its rapid adoption in a wide range of uses, it is not unreasonable to expect the technology will improve to the point that privacy concerns will be more valid.

    From a security/ease-of-transaction standpoint, I think RFID adds little if anything to a security system. Security is based on three things: something you know (a password), something you are (DNA, biometrics, etc.), or something you have (a key, identification, whatever). There are ways to circumvent each of these, but RFID is essentially something you have and not fundamentally different from a physical key. Its only advantage is the ability to carry more information, essentially making it harder to copy than another document. As a copy-protection scheme, it's hardly an optimal solution, and as anything else it's silly - at the end of the day, all of the relevant data for a passport/ID can be on a central database which can be accessed by something as simple as a reference number.

  23. #23
    Some euros keep their ID and credit cards in a metal envelope, so they can't be scanned unless they know it. Was that because of RFID?

    I read about Walmart putting these things on all their US merchandise, at quite an expense, to make inventory and purchasing more coordinated and efficient. Privacy advocates were concerned about purchases with these tags that might be connected to credit/debit on receipts with bar codes, and that unscrupulous tech-criminals could scan curb-side garbage and possibly get private information (to steal identity).

    Who makes sure these data bases are hack-proof? And are they reliable (or as vulnerable as US SS and UK NHS hacked data bases)?

  24. #24
    Senior Member
    Join Date
    Jan 2010
    Location
    Amsterdam/Istanbul
    Posts
    12,313
    Quote Originally Posted by GGT View Post
    Some euros keep their ID and credit cards in a metal envelope, so they can't be scanned unless they know it. Was that because of RFID?
    Not really, the metal box was to reduce the number of broken cards, now it has the additional advantage of limiting access to the information on the chip.

    Steely; a passport is not only bigger, but the card is also cheaper than a passport. Identity theft also is a lot tougher if you need more than a person's information from letters sent to him by a bank.
    Congratulations America

  25. #25
    Quote Originally Posted by Hazir View Post
    Not really, the metal box was to reduce the number of broken cards, now it has the additional advantage of limiting access to the information on the chip.

    Steely; a passport is not only bigger, but the card is also cheaper than a passport. Identity theft also is a lot tougher if you need more than a person's information from letters sent to him by a bank.
    I don't trust any of this technology, to be honest. Not just because I don't wholly understand how it works, but because I don't trust (my) government to limit its use or protect my privacy, and I especially don't have faith that private use won't abuse consumers AND government safe-guards.

    I've read some tech news that's got retailers all excited about the potentials with RFID---walk into a store, purchase an item by walking through the exit scanner; all the codes match your ID plus the credit card in your wallet, with the merchandise. No standing in lines or hiring cashiers. Nanosecond transactions. The retailer can know when to replace merchandise, contact vendors at a snap, and send you adverts and coupons. Transmitted to your smart phone or home email. Presumably this'd make air travel faster and more streamlined, too. With "alerts" on certain IDs, connecting Homeland Security and TSA with Interpol and....others.

    Doesn't take much imagination or paranoia to see how this could be abused, does it? Buying a hat, sunglasses and a backpack at Walmart (plus maybe some ammo for deer season, or a disposable phone camera for your beach vacation), then a plane ticket to XYZ could land you on a no-fly list. Or that "special room" where people with gloves, scanners, and interrogators wait. Meanwhile, the real terrorists have bypassed the system.....

  26. #26
    Senior Member Draco's Avatar
    Join Date
    Apr 2010
    Location
    Brisbane, Australia
    Posts
    573
    ^^You should be writing for films
    Quote Originally Posted by RandBlade View Post
    So I have a card (which I have to have due to law) in my wallet and I lose my wallet. Next thing, not only can someone get my private details on that card but they can use that card to do secure online shopping and interact with government services etc in my name? Is that right?
    I'm sure you could call the card/RFID company or whoever is responsible for your ID card and get them to disable it/remove information.

    RFID traces it's roots back to a bug or listening device invented by some Russian guy to spy on the Americans http://en.wikipedia.org/wiki/Thing_(listening_device) just thought that was interesting to share. Then again, if governments plan on putting an antenna into these ID cards, they'll be able to hear everything

  27. #27
    Quote Originally Posted by Draco View Post
    I'm sure you could call the card/RFID company or whoever is responsible for your ID card and get them to disable it/remove information.
    Not really. The thief could call, pretending to be the card holder. Because they can follow Rand applying for new numbers and cards, they'd appear even more legitimate or benign when they steal the information.

  28. #28
    ... okay, so the thief can call and have the card made invalid.... for greater profit...
    "One day, we shall die. All the other days, we shall live."

  29. #29
    Quote Originally Posted by Aimless View Post
    ... okay, so the thief can call and have the card made invalid.... for greater profit...
    Have you read much about today's identity theft, and our "lesser" capabilities? Try applying to medical school or for a medical license with a background check in the future.

  30. #30
    No I mean either you call in to have the card disabled or the thief does, either way the card is disabled, so I'm not sure why you were objecting to Draco's remark.
    "One day, we shall die. All the other days, we shall live."

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •