So my bank (US Bank) just sent me a new debit card with the useless Visa RFID payment thing. Sometimes, I wonder how hard it can be to just swipe the card like we've been doing for decades, then I remember when I worked at Target and how half of our customers were morons who couldn't figure out how to swipe their card. Maybe this is good for them. But I digress....I've heard a lot about these cards...are they pretty secure, or should I try to do something to disable the RFID chip on it
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Bank sent me a debit card with RFID; should I get out the tinfoil hat?
- Thread starter yg17
- Start date
- Sort by reaction score
Being a country lad I'm a bit out of the loop ... but what does the RFID thing do on the card? I know about how RFID is used in tracking goods through a supply chain and I'm also aware about how if it's developed it could be another major state intrusion but I don't know what it's doing on a credit card.
You should be a little concerned about any technology that allows your card to be read without you taking some positive action.
Unless there have been significant developments in the last year or two, tags supporting cryptography cannot be powered inductively off the antenna, and as a result must be larger than you'd find in a credit card form factor. Therefore there is little meaningful way for the manufacturer to secure the data on the card that isn't susceptible to cloning. Even some crypto tags have been found to incorporate uselessly weak algorithms.
Implementors of technologies like this have a somewhat bad track record anyway. Chances are really good that reading the tag will present, in the clear, exactly the same information you'd get by swiping the magstripe.
But with a tag read someone who can get sufficiently close to you, such as in an elevator, on a bus, or walking behind you into or out of the store, might be able to surreptitiously read the chip while it's still in your wallet. It's just like a pickpocket, except he's just palming a reader, so you won't know the guy who just "accidentally" bumped into you lifted your debit card until the money starts disappearing.
With a little hacking one can come up with an antenna that, though it wouldn't be reliable enough for production use, could get lucky and nab a few successful reads a day from a few feet away. This sort of attack has been demonstrated to increase the read range for some short-range tags from a few centimeters to a few feet.
There's a lot of paranoia about RFID tags, some of it exaggerated and panicky (no satellite tracking), some of it quite legitimate cause for concern. The permanent solution is to whack the chip part with a hammer, which is easy enough, but really burns your bridges. I wouldn't do that myself. Ironically enough, keeping your card in a sleeve made of aluminum foil will probably provide enough RF shielding to block reads. Some people will sell you fancier sleeves, and even wallets with built-in shielding, but whether that's something you'd want to shell out money on is up to you.
Unless there have been significant developments in the last year or two, tags supporting cryptography cannot be powered inductively off the antenna, and as a result must be larger than you'd find in a credit card form factor. Therefore there is little meaningful way for the manufacturer to secure the data on the card that isn't susceptible to cloning. Even some crypto tags have been found to incorporate uselessly weak algorithms.
Implementors of technologies like this have a somewhat bad track record anyway. Chances are really good that reading the tag will present, in the clear, exactly the same information you'd get by swiping the magstripe.
But with a tag read someone who can get sufficiently close to you, such as in an elevator, on a bus, or walking behind you into or out of the store, might be able to surreptitiously read the chip while it's still in your wallet. It's just like a pickpocket, except he's just palming a reader, so you won't know the guy who just "accidentally" bumped into you lifted your debit card until the money starts disappearing.
With a little hacking one can come up with an antenna that, though it wouldn't be reliable enough for production use, could get lucky and nab a few successful reads a day from a few feet away. This sort of attack has been demonstrated to increase the read range for some short-range tags from a few centimeters to a few feet.
There's a lot of paranoia about RFID tags, some of it exaggerated and panicky (no satellite tracking), some of it quite legitimate cause for concern. The permanent solution is to whack the chip part with a hammer, which is easy enough, but really burns your bridges. I wouldn't do that myself. Ironically enough, keeping your card in a sleeve made of aluminum foil will probably provide enough RF shielding to block reads. Some people will sell you fancier sleeves, and even wallets with built-in shielding, but whether that's something you'd want to shell out money on is up to you.
Dude - that advice is way to sensible.
You need more exclamation marks and you really need to take a side on this. Everyone here needs to take sides in the arguments and stubbornly defend them to the end.
If you want to be really cool, take out the RFID chip and install it in your hand. That way you can pay for your goods with 'the force'
It is only a sign of the things to come. Good luck defeating it. You may deactivate it in the process. Progress, you got to love it. 
Don't be so quick to judge people about that. It's not their fault.
I'm an engineer and I have problems with card swipers. Why? Because it isn't standardized. Different stores have different systems, and different systems have different ways to swipe cards, and most of them have graphics to show how to swipe that are ambiguous and open to interpretation. I often get it wrong the first time I go into new store. The ones that are well designed are easily, but a lot are poorly designed.
It's not the users who are morons. It's the human interface designers who are. I'll bet a lot of people reading this know exactly what I mean.
Then I hope strippers and hookers don't start installing RFID readers all over their body. Could get expensive.
Umm..good one.
Unless you're one of your poor customers at Target the RFID should help you. Visa now has a 27 billion dollar market cap and should be spending that money on easier ways for people to use credit cards. Soon the RFID readers should become more prevalent.