As my readers know, I don't much like e-Passports. I don't understand what their benefit is supposed to be, and I certainly don't want people scanning my passport remotely, without my knowing. Today it has been revealed that the chip in the passport (10-year validity) has only a 2-year life. An article in The Register also claims the chip is too small to hold the necessary data and operating system to support two fingerprints. What a surprise.
Today I saw an article on the BBC web site which made we glad that I've bought my anti-RFID passport holder. The disclosures in the article confirm what I've always thought, the rfid chip does nothing significant to increase security and does something significant to reduce security. Now, I may be wrong, I don't understand enough about the cryptography used (they do use some cryptography, don't they?), but it is possible that while it is relatively easy to clone a passport, it may be difficult to create a new one from scratch. To clone, all that is needed is to copy the (encrypted?) chip, to create a new one you may need to do the encryption and you might not have the key. Does anyone know? Maybe there is method behind this scheme, rather than the madness of increased costs and decreased security.
So what has this to do with DVDs? When I had the CSS scheme first described to me, I couldn't understand what it was good for. Clearly it didn't prevent cloning a DVD - if you clone all the digital content you have a clone of the DVD. A serious fraudster - one with a pressing plant - shouldn't have a problem in mass producing fake DVDs. Then I realised; the mechanism was there to enforce the licencing policy. To play back the DVD you need the algorithm. To get the algorithm you need to sign a licence. Provided CSS is patent protected you have a case against anyone producing a player which doesn't confirm to your licencing terms. If it's made by a licencee, they're in breach of their licence; if it's made by a non-licencee, they're in breach of your patent.
I'm still working on the changeover from my old computer to my new one so I've been unable to investigate my anti-rfid passport holder yet. But the more I think about it, the more I think that anti-rfid is great marketing idea. Fear-Uncertainty-and-Doubt- rfid has it all in spades. Anti-rfid goods are the way to go. Only question is how to develop my business plans; I need to talk to Varoom.
It looks great, my UK passport fits it snugly, there is a wonderful smell of leather. I'll post a photo shortly.
Meanwhile, a question: How do I check that it really shields the RFID chip?
Well, I do seem to have found a hot topic. Today's Guardian runs a story about the UK RFID Passport having been hacked. All the details are in the article but one item caught my eye, the passport was been read from a distance of 7.5 cm - much further than the 2 cm distance that the UK government claim is possible. I'm looking forward to the delivery of my faraday cage passport holder.
As promised, an update about anti-RFID passport holders. The vendor can be reached through the link below. I can't recommend them yet; I have haven't tried, but I'm about to.
In a comment to my last post, Justin Mason of taint.org tells me that there are shielded passport cases available. I'm going to get my hands on one to try. I'll let you know how I get on. Any hints on how to test it are welcome.
My picture of the RFID hardware in my new passport has created more comments than anything else I've posted. Now, I carry my passport with me quite a lot when I'm traveling, and I don't like the idea of people being able to read my passport remotely. The claim that "the range is limited" isn't good enough - I've seen enough about bluejacking to be worried. I think I could be the target market for a combination Faraday cage and passport pouch. Maybe as my anonymous commenter says, wrapping it in aluminium foil is good enough technically, but as a style statement it sucks. And although the idea of microwaving my passport appeals (especially as I am now the proud owner of a 1000W microwave oven - warms a chilly bottle of red wine nicely in less than a minute) I have a sneaking suspicion that there might be times where I want the RFID to work as designed. I don't want to spend hours proving my identity so I can get back into the UK.
Posts
All Comments
