Schneier on Security

Roger • May 12, 2010 4:22 PM

@Vic:
> I don't believe that any other country save for America uses something as silly as RFID in their passports?

No, everyone know either has it or is rapidly moving towards it. By some looming deadline (can't be bothered looking it up) non-RFID will no longer be accepted by most countries.

@vwm:
> Guys, do you really expect a random cutpurse to use a Faraday bag?

Absolutely -- many shoplifters already do.

> By the way, probably the alarm will go off *when* you place this toy in the bag, as this will interrupt the bluetooth contact .

Here, I think you are right. What the thief actually wants is a sound-absorbing bag, to slip the wallet into before it hits the 10' mark.

@Ken Williams:
> First, people probably drop their wallet ...far more often than wallets get stolen,

I have no idea how to assess the accuracy of that view, but from personal anecdote I would say it is not even close. But then I have lived in a city with a fairly high incidence of pickpockets.

> Second, when a casual thief steals a wallet, my impression was that they only wanted to hang on to it for like 30 seconds or less, grab the cash & cards, then toss it in a dumpster.

Umm, no. At least around here, pickpockets work in a team of three: the distracter (often a pretty women, sometimes a child), the actual pickpocket, and the hand-off guy. The pickpocket doesn't hold the wallet for 30 seconds, he/she hands it off in under a second. Often the pickpocket is dressed to facilitate easy frisking, to "prove" innocence.

The hand-off guy is a respectable looking person, often a senior citizen, with some kind of concealment device to hold the loot until they get back to their van to divvy up the last half-hour's worth of takings.

A siren on the wallet would screw up this system until they figured out how to sound-proof the hand-off guy's briefcase.

> I'm guessing the most likely scenario with this thing is that they grab it, can't open it (or figure it's a fancy cigarette case), then toss it.

There is no way they would toss something this fancy.

> Theoretically they could bring it home & crack it open pretty easily, but I'm guessing that wouldn't happen very often - & then you're just back to Wallet 1.0 anyway, except that you potentially bought some time to call & cancel your cards.

I think you seriously overestimate how hard it would be to open. With just the tools you could carry in the back of a panel van, I am certain I could open it in under a minute. If I took five minutes, it would probably even be repairable, and the crooks could take it to the pub "hey, wanna buy one of those fancy $600 wallets?"

Roger • May 12, 2010 4:42 PM

My assessment:
* far too expensive at $600. Even the fibreglass one is $400. For that sort of price I expect titanium.
* extremely uncomfortable looking, with a bulky, rigid case
* holds 4 cards and 10 money bills. Ten!?! That makes it pretty well useless to me.
* with all features enabled, the batteries only last 3 days!! I'd be constantly suffering from a flat wallet!
* The fingerprint reader is not a great idea. Apart from a lock providing very limited benefit on a highly portable object, wouldn't a hard-cased wallet be the perfect place to find a fingerprint? However I do see that they are trapped between a method that is adequately secure, and yet convenient enough for a wallet. I don't know of any ideal solution to this, but maybe a better solution would have been to open easily when in Bluetooth contact, and require a PIN when not in Bluetooth contact?
* The RFID shielding seems like a fair idea, but I cam sceptical about just how effective carbon fibre is for this function. Plus for all cards I have that have this feature, I already have cheaper shielding that I have tested (and no, I am not talking about al-foil; it looks like a silver cigarette case.)
* The Bluetooth controlled alarm is a reasonable idea, in that it thwarts the standard pickpocket tactic of the hand-off. However, unless you make the siren ear-splittingly loud, this will be trivially counter-thwarted by a few layers of towelling and a noisy crowd. And if it is ear-splittingly loud, then false alarms will be a bitch.

Roger • May 13, 2010 5:52 AM

@John Paulson:
> So because it does not provide absolute security, it is not worth it.

No, we are all well aware that nothing provides absolute security. This one is "not worth it" because it provides very little additional security, has greatly impaired functionality (only holds 10 banknotes!), AND is extremely expensive (USD $600 for a wallet!!)

> In that vain because a talented cracker can break into my $20 dollar firewall it is not worth putting up a firewall at all.

Bad analogy. This is more like: everyone who cares already has a $20 firewall that will stop script kiddies but maybe not talented hackers. Now somebody wants to sell you an enhanced firewall which costs $1,000, oh and by the way you can only access the internet through it a maximum of 1 hour per day. But it's super-secure right? -- erm, no, it still only stops script kiddies.

> Sticky handed waiters,

Yep, I'll grant, it might make life harder for a wallet-stealing waiter. But speaking of movie plot threats -- when have you ever had your wallet stolen by your waiter?!? Dishonest waiters steal by short-changing you or manipulating the bill (both offences which have a relatively low risk of being caught, and almost no risk of prosecution), not by taking physical property (which has a high risk of ending up in court.)

> pot smokin teenager son or daughter, the crack addict mugger.

Que? I'd like to politely suggest that you haven't thought that through from the point of view of the criminal. This wallet would be only a trivial hindrance to a thief in your own household, and completely and utterly useless to prevent mugging (in fact in a mugging, it increases your risk of being seriously hurt.)