Sunday, May 23, 2004
RFID and Biometrics in Passports In the UK Register, Thomas C. Greene delivers a strong criticism of RFID and biometrics in passports as advocated by the United States and certain European governments. Generally I agree with Greene when he states that biometrics by themselves are not a major problem in passports as long as they require contact with the passport to be read.  Adding RFID enables passive, involuntary reading and that creates risk. Greene should have mentioned security and authentication features that are available to limit unauthorized reading.  Despite that, he clearly and eloquently highlights the important issues. 10:17:41 PM    comment [] Wi Fi Tags at Legoland A recent article in Network World Fusion describes a system for finding lost children at Legoland Billund in Denmark.  Parents can rent wrist bands containing Wi-Fi tags.  The park has an extensive wireless LAN that can track the location of any wrist band (and any kid) within 5 feet of their location. The system was developed for Legoland by Bluesoft and KidSpotter A/S. 10:04:43 PM    comment [] Jonathan Westhues responds Jonathan Westhues is the author and engineer who wrote about cloning Pro-X RFID cards.  He offers this reply: "It seems I was unclear: the Motorola Flexpass card that I worked with does not use challenge/response. My device is more than a reader; it is also a simulator. If I power the coil then I can read a legitimate card, and store its ID in memory. At that point if I replay that ID to a legitimate reader then the door does open. In every sense, I can clone that card. "I could have performed the first operation with a commercial reader, but not the second. "I am not familiar with the "Pro-x" trademark, and I do not know whether those cards use challenge/response. However, my Motorola Flexpass card, and every other card that I've chanced to encounter, do not. "As far as I can tell, there is no other information on that card. I have never tried to use it to do anything but open a door, and my device, having cloned my legitimate card, will do that." 2:58:46 PM    comment []