Schneier on Security
A blog covering security and security technology.
« Countering "Trusting Trust" |
| 43rd Mersenne Prime Found »
January 23, 2006
Reading RFID Cards at Yards Away
This article talks about a not-a-passport ID card that U.S. citizens could use to go back and forth between the U.S. and Canada or Mexico. Pretty basic stuff, but this paragraph jumped out:
Officials said the card would be about the size of a credit card, carry a picture of the holder and cost about $50, about half the price of a passport. It will be equipped with radio frequency identification, allowing it to be read from several yards away at border crossings.
"Several yards away"? What about inches?
Note: My previous entries on RFID passports are here, here, here, and here.
Posted on January 23, 2006 at 12:27 PM
• 27 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Chances are this is what the journalists believe, not the official version and not necessarily correct. There's a lot of confusion about those chips which really needs to be sorted out.
Why do we need yet another ID card for travel between the US, Canada, and Mexico, when a passport is still a perfectly valid solution (and will work for travel to other countries, too)?
So... a new ID, that serves the purpose of a passport, that requires the same documentation as a passport, and costs close to the same as a passport. Brought to us by the department of redundancy department?
Sometimes I think there must be some special "stupid cereal" that all government employees (or at least politicians) must eat for breakfast or something.
We 'need' this thing because a passport doesn't fit in your wallet. It's much more convenient. Maybe the previous posters are in the habit of carrying their passport around with them, but I'm not. A card like this can go into my wallet, and be forgotten until I need it, just like my insurance card.
It's also probably better to lose the card then to lose a full-fleged passport, because since it is a less useful document, it probably has less value on the black market.
Sounds like the ideal solution for young guys who want to head over to mexico and get drunk on weekends. Probably works well for frequent travelers too.
Sounds redundantly redundant, but at least the ID theft capabilities are included free of charge.
"We 'need' this thing because a passport doesn't fit in your wallet. It's much more convenient. Maybe the previous posters are in the habit of carrying their passport around with them, but I'm not. A card like this can go into my wallet, and be forgotten until I need it, just like my insurance card."
Yes, just what's needed: a handy dandy national identification card with your photo which can be read by someone standing next to you while it sits snuggled in your back-pocket. Also handy for the police to demand to see the next time you're caught doing something suspicious, like breathing.
The "need" is because many in the US who live in border towns have grown accustomed to crossing the US/Canadian border daily and with little hassle (bloody chainsaw, as always, is optional). Requiring a passport would slow things down "too much". I suspect the US/Mexico angle is similar -- wouldn't want it to be too much of a hassle for citizens to get back from Tijuana.
In short, the USG wants to have it both ways -- fast and secure. Naturally, it WON'T be cheap ;^).
The only "reason" for this card is that it is less expensive than a passport (about half, according to the article, though RFID passports in Europe are going to be much more expensive than that). They are afraid that people won't travel any more of they need a passport for a trip over the border.
Perhaps the thinking is that this ID won't be stamped when you cross the border, do they do that with passports at the US-Canadian border? If so, and you are a frequent traveler, your passport could fill up rather quickly.
New ID = $50 once
Passport = $100 10 times a year
Which would you prefer? Of course that's if they stamp passports at that border.
I wouldn't be too worried about this just yet. Too much economic activity takes place across these borders for something this expensive to be practical. And it isn't any kind of national ID either. Nobody would need one of these unless they cross these borders frequently, but do no other international travel, so they're rather useless for the US police to demand of people.
The "need" is so that workers crossing over at tourist checkpoints like Niagra Falls will can use thier own no-tourist-allowed lane and not be late for work. This lane exists now but the the new requirement to show a passport is forcing the workers to stop thier cars when crossing the border, slowing things down.
> Do they stamp the passport going into Canada
No, you just have to show it.
I suppose that you have weigh the convenience of faster border crossing versus the identification redundancy of having a passport *and* a card, as well as the many previously discussed security issues involved with an embedded RFID holding the data.
Speaking of which, just how much faster would it be? It's all well and good to be able to read the RFID from a distance, but like a passport, the photograph and any other biometric keys will still have to be verified in person. So what make s the card quicker or more convenient than a passport? Size? If that's the only advantage, I'm not sure that I see the point.
This has more application for non-U.S. citizens than for. As a Canadian, if I could apply for a card to expedite travel, then it would simplify things. Of course, the many times I have gone to the U.S. I have never had to show more than my drivers license.
So sad that these weak controls are going to do nothing more than slow down travel.
On the plus side, with the aggravations of passing through the U.S. now, hopefully more airlines will arrange direct flights from Canada overseas!
Americans travelling to Canada do not require a passport; photo ID and proof of citizenship is all that is required. Come Dec 31, 2006, you will need a US passpport to get back into the USA. I assume this 'passport lite' will suffice.
> "Several yards away"? What about inches?
Ever cross the border in a car? Several yards is the right answer. You want to sit in your car or truck, wave the card at a reader several yards away, then drive thru the brief interview. (Of course, I'm identifying the convenience requirement, not a security requirement.) You want to see backups-from-hell at the border, then require a "few inches".
We "need" this because the gummint needs to create more pork. Just like we "needed" to give a lucrative no-bid contract to Halliburton, et al.
It seems it's not a real passport, but a "mini" passport designed just for the Mexico/US/Canadian border. I'm sure this mini passport has been designed so it can be read at a distance for ease of passage. Although I'm sure this mini passport will be a screaming success and all passports will require the easy read RFID.
If you know the Mexican/US border,
you know why they came up with
this tech-solves-our-problem idea.
I know I'm picky, but wow! Such a long
article for laying out such a simple
Maybe it is newsworthy that someone
took this idea and formalized it. But
then on the other hand, finding the
"bad ones" by compaing it against
the "other/good ones" is what I do
each week in the supermarket to get
the good fruits. The "trusted" or "good" fruit is then in my mental picture.
just my 2 cents
As the EM waves do not stop at a fixed point (they merely decrease with distance), comments like "a few inches" are worthless. Increase the chip's emitting power, or the receiver's sensibility, and you get a larger range. But the USG (and others) like to think they can adjust the range at will, something like "this wave will self-destruct after travelling 10 inches"
Several yards away? Bad for privacy. But, at least some guys in the USG know something about laws of physics.
>Increase the chip's emitting power
rfid chips dont emitt power. the are powered by the power of the receiver.
>and you get a larger range
is physicaly impossible. I am not a physic but there is a maximum distance for powering rfid chips. the following comment comes from another thread about rfid chips:
"Passive RFID tags are powered by the reader, and HF tags are powered by
induction; this severely limits their range. [...] The ISO 14443 standard uses a 13.56 MHz signal, with a wavelength of
about 22m. ISO tags are powered by inductive coupling in the reactive
near field, where power drops off with 1/d^3. This means that since
the standard read range is 0.1m (10cm), to increase that distance to
1m, you would need to supply 1000x more power. Since the power
supplied to an antenna is normally limited by FCC rules to 1 Watt, this
would mean you'd require 1 KW to power them at 1m, or 1MW at 10m. You
may be able to eavesdrop on the signal at a long distance, but unless I
completely misunderstand this stuff, you won't be powering it at that
distance. Technology gets better, but physics just doesn't change.
so dont panic :)
I find this all quite sad. There was a time when you could cross these borders easily without justifying your existence to anyone, and that time is within living memory. The towns (and bars and houses) that straddle national borders in the northeast are a reminder of how much freedom we've lost and how quickly it's happened.
The DHS announcement probably is no more than an expansion of the existing NEXUS card program, a successful joint project between the US and Canada that uses RFID cards and costs the participant $50 for five years. See getnexus.com for program details. It is optional. It's not terribly valuable for a thief as it's not good for anything else, doesn't store any data, and you still need to carry your passport as the border agents reserve the right to (occassionally) ask to see it too. But it immensely shortens the wait at the border for frequent travelers.
"The "need" is so that workers crossing over at tourist checkpoints like Niagra Falls will can use thier own no-tourist-allowed lane and not be late for work."
No, those cards will be required for everyone (unless they have got a passport).
"Ever cross the border in a car? Several yards is the right answer. You want to sit in your car or truck, wave the card at a reader several yards away, then drive thru the brief interview."
This may seem convenient, especially for anybody who wants to spy. But it won't happen like that. Border control will be as it is today, except that a different kind of document will be required.
"The DHS announcement probably is no more than an expansion of the existing NEXUS card program".
I don't think so, but NEXUS isinteresting:
"NEXUS is a joint customs and immigration family of programs for frequent travellers that both the Canadian and American governments have implemented. The NEXUS programs are designed to simplify border crossings for pre-approved, low-risk travellers."
Incredible. Don't be surprised if some terrorists have such a card. "It's not terribly valuable for a thief" except if the thief happens to need to cross the border for some malicious reason. On the other hand, I don't think crossing the land border is too difficult for bad guys so it might not matter anyway.
To someone who wondered... they do not stamp your passport at the Canadian border, not going in either direction. I have a passport I got last July (extra credit: why?) and the only time it's been stamped was when I went to & from Paris this fall.
to clarify, I go back & forth to Canada a lot, the Niagara Falls casino has a very soft poker room now.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.