Apple didn't talk much about the exact implementation of their RFID system. They didn't even mention which frequency they'd be using (LF, HF, UHF (EPC Gen2?)). Its most definitely would be a passive system though.
Basically, the RFID tag is being used to store basic network information. I'm assuming SSID. If they are smart, they may also store a public key.
Then, the RFID portion is done, and the devices will connect using wireless to communicate the rest of their settings. This is why I said it would be good of Apple to have included a public key in the RFID tag. this would enable the devices to talk relatively securely even over an unencrypted channel to exchange WPA keys. Then, the full wireless security framework would be set up.
The biggest problem I see in the proposed solution by Apple is that an attacker in close proximity could get the connecting device to look at the attacker's RFID instead of the intended device. This would basically make the user's device connect automatically to the attacker's device. Oops! However, this would require an attacker in relative close proximity, and if they are further away than the user's connecting device, then they would need a higher gain output to try to trick the device. Its just one of the security implications Apple would need to work to prevent from happening in the field.
Thanks longofest. Sounds about right to me. I think the objective here is to provide security on a wireless signal by ensuring that the individual using the wireless link has physical access to the base station. This could be further enhanced by adding a button to the base station to minimize the chance of the high-gain remote attack. A hacker might be able to collect the credentials remotely if they're listening when the button is pressed, but they couldn't trigger an authentication remotely.
Passive RFID would make the most sense from a cost standpoint-- put the expense of the reader into the base station and each device has pennies of incremental cost.
You complain about the tracking abilities of RFID, yet you don't worry about the tracking ability of mobile phones? Mobile phones can be pinpointed and tracked over a far greater distance than RFID can. Same thing with GPS devices.
Just to extend the battle against FUD on all fronts, there is nothing about GPS that allows anyone to track you. GPS is passive only-- the satellites transmit but the user only receives. Remember this was a military technology and they aren't very keen on their soldiers broadcasting their position. GPS can only track someone if they transmit their position over a separate transmitter.
Cellphones, on the other hand, are quite powerful transmitters and are easy to track and triangulate to.
You seem to be concerned regarding tracking abilities of RFID. I believe the conspiracy theories and "security risks" regarding tracking abilities of RFID are extremely over-blown.
First, lets make an assumption we're talking about passive RFID. In response to Peace's comment, yes, RFID could be read even when not powered on, however this is mitigated by the fact that you can place some RF-interferance material over the chip and it would no longer respond. There are other techniques that can be employed as well in newer generations of RFID (tags can be programmed to only respond to certain readers, etc).
However, the main point that I would make is that you have to be in relative close proximity to an RFID tag to read it. Therefore, you'd have to have a network of readers to track someone. While this kind of scenario does occur in supply-chain management (networks of readers in a warehouse and along highways to track trucks, for instance), the potential to do it otherwise isn't that huge.
Now, back to your original point. Why is apple using RFID instead of Bluetooth or something else? Well, BlueTooth requires pairing, so its doubtful that they'd use that specific technology, but still, they could use a different technology, and I don't know why they aren't. To be honest, it sounds like they would save themselves from some headaches by not using RFID but using a similar principle to what they are suggesting, minus the RFID.
I should probably be responding to EagerDragon here but your post better covers both sides of the issue... The danger in RFID as a privacy/security threat is two fold but it's always tied to the information that the RFID provides.
The threat that EagerDragon raises is the ability to follow you around town which is theoretically possible, but as you point out that is rather impractical for very short range devices. Wallmart can track you around the store if they choose, but following you home would require a grid of tag readers spaced every few feet across an entire city. This is roughly the equivalent of the Nike Jogger Stalking threat that got a lot of attention with their iPod integration.
Wrapping the device in foil helps reduce range but only mitigates the threat, it doesn't eliminate it. As the British will tell you, the foil cover on their RFID passports doesn't prevent them from being scanned by the sufficiently motivated. The problem in that case is different though, and it points to the other danger of RFID:
The problem with the British passports is that the data transmitted contains real information not just a meaningless identification number. This is bad implementation. If RFID is broadcasting an identifier that is is divorced from other information, it allows you to track the device, but not to learn anything about the person carrying it. If the RFID carries useful information in itself, as it does with the passports, then you have a real privacy/security concern-- as with the ability to know the contents of and clone a passport without ever having held it.
Wallmart may know the ID for your shoes, and they may have even linked that ID to your credit card data so they know more about you which is spooky in itself, but for that threat to spread they'd need to share that information with others. If the RFID is spitting out your name and address, then it is poorly implemented and you've got the same problem that the passports have.
The way I see this fitting in with the Apple application is this: I don't care much if my iPod or remote control spits out a meaningless ID when polled. Maybe I'd feel differently if I was in a position where someone might want to activate a device only when I'm next to it, but there aren't many people with that concern and it's easier to accomplish the same goal with a pair of binoculars and a remote control anyway. What I don't want is anything on me to be spitting out anything that is useful in itself and this doesn't seem to do that on the device side-- only on the base station side (and this is easy enough to plug as I mentioned above).
Overall, it's a question of whether this is a net positive for security or a net negative. Despite what people are saying here on the forum, I know for a fact that there are a large number of people who aren't able to secure their networks properly and as the ubiquity of wireless links grows, the problem is only going to get worse. The threat of someone following my RFID tag around is much smaller than the threat of someone listening in to all of my WiFi transmissions-- because those transmission carry useful data.
The one remaining attack point that I'd be worried about is not rogue devices connecting to my base station, but rogue base stations linking to my device. If the device is dumb enough to connect to any base station it's close to then someone could set up a base station under a bus seat and harvest information by establishing secure links with any device that goes by then polling it for more useful data. A simple button press might be sufficient to mitigate this one as well...
