US Passports as RFID Greeting Cards

[David Farber <dave () farber net>]

------ Forwarded Message
From: Bill Scannell <bill () scannell org>
Date: Sun, 24 Apr 2005 14:42:18 -0400
To: John Morris <jmorris () cdt org>, <dave () farber net>
Cc: Henning Schulzrinne <hgs () cs columbia edu>, "Bruening, Paula"
<pbruening () cdt org>, "Schwartz, Ari" <ari () cdt org>
Subject: US Passports as RFID Greeting Cards

John,

The light sensor idea is a curious one.

While you're at it, maybe you could use the extra ROM on the chip to play a
song when the light sensor is activated.  Might I suggest "Every Breath You
Take" by The Police?

RFID is an inappropriate technology for use in any identity document.
Faraday cages, Fritos bags or light sensors may lesson the danger of the
chip, but the simple fact is that passports will be opened and read by
people other than US immigration authorities.  Dr. Evil (or Mr. Thief)
merely needs to have one of his minions take a job as a hotel desk clerk to
be able to get a perfect digital copy of your passport photograph, as well
as your personal details, in order top create other, less secure, identity
documents with this information.

I wish that CDT would spend more time lobbying the Hill trying to kill-off
this dangerous plan rather than floating ways to put a smiley face on an
inherently bad idea.

All the best,

Bill

http://www.rfidkills.com

 ------ Forwarded Message
From: John Morris <jmorris-lists () cdt org>
Date: Thu, 21 Apr 2005 16:36:02 -0400
To: <dave () farber net>
Cc: Henning Schulzrinne <hgs () cs columbia edu>, "Bruening, Paula"
<pbruening () cdt org>, "Schwartz, Ari" <ari () cdt org>
Subject: Re: [IP] more on more on on RFIDs in passports

 For IP....

 Dave,

 We should not jump to the conclusion that there exists no possible
technical solution to the problems posed by RFIDs in passports:

 At 11:33 AM -0400 4/21/05, David Farber wrote:
------ Forwarded Message
 From: Russell Nelson <nelson () crynwr com>
 Date: Thu, 21 Apr 2005 10:25:56 -0400
 To: <dave () farber net>
 Cc: "Jonathan S. Shapiro" <shap () eros-os org>
 Subject: Re: [IP] more on on RFIDs in passports

 <SNIP>
The real objection remains: how do you create a chip which everyone
 who you DO want to read it gets to read it, but nobody you DON'T want
 to read it can read it, and which does not require any action on your
 part.  There is no solution to this problem; thus RFIDs cannot be made
 to work securely.

 In a brief note posted today, Henning Schulzrinne, Chair of the Columbia
Department of Computer Science, has suggested a couple of seemingly viable
methods for preventing passport RFIDs from being read by unauthorized
readers.  See http://www.cs.columbia.edu/~hgs/papers/2005/passport.pdf,.

 The most intriguing idea that Professor Schulzrinne advances is to include
a "light-sensitive element" on an inside page of the passport, such that the
RFID is only capable of responding to a reader when the passport is opened
to, say, the inside cover/first page where the picture appears.  As
Professor Schulzrinne explains, "if the passport is closed, the RFID
circuitry is disabled."  This type of technology is used in some greeting
cards, and thus likely would not add too much cost above and beyond the cost
of the RFID itself.  The fuller description of the idea is:

Light sensor: A light-sensitive element embedded in the passport center page
only activates the RFID circuitry when sufficient light falls onto the
passport. If the passport is closed, the RFID circuitry is disabled. A
simple photo-sensitive resistor can serve this purpose and does not require
any active circuitry. This approach is similar to one used by electronic
"singing" greeting cards that play their tune when the recipient opens the
card. Ambient light is sufficient to activate the circuitry, so the customs
official would only have to open the passport in order to obtain the data.
The additional cost of such circuitry appears extremely modest, as they can
be embedded in greeting cards.

 I would be interested in any problems with this approach that your readers
might raise (as I am sure would Professor Schulzrinne, who I have cc'd on
this e-mail).

 John Morris

 -- 
 ----------------------------------------
 John B. Morris, Jr.
 Staff Counsel
 Center for Democracy and Technology
 1634 I Street NW, Suite 1100
 Washington, DC 20006
 (202) 637-9800
 (202) 637-0968 fax
 jmorris () cdt org
http://www.cdt.org
 ----------------------------------------


 ------ End of Forwarded Message


··· --- ···  ··· --- ···
"They that can give up essential liberty to obtain a little temporary safety
deserve neither liberty nor safety."
- Benjamin Franklin




------ End of Forwarded Message


-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/