I came across a topic today that seems worth discussing: RFID Credit Cards. Many people know this technology as “PayPass,” or something similar where you can pay for items just by waving your credit card near a sensor. Apparently, many banks are sending out new credit cards with this technology embedded, some lacking a non-RFID option. I felt it would be beneficial to post an overview of RFID technology, how it is being used with respect to credit cards, and why you should RUN THE OTHER WAY if your bank tries to push one of these cards on you.

Radio Frequency Identification (RFID) chips are electronic components used to communicate small pieces of information without any physical contact between the data carrier and the data receiver. The technology used is similar to wireless networking or mobile phones (both use radio frequencies to transmit data), but with a shorter range, and less security. The interested reader should check out the Wikipedia article on RFID for a more complete description. One common application of RFID technology you might be familiar with include those pesky security devices inside the DVDs you purchase from Wal-Mart. These are passive devices that are read by the turnstiles at the exits. Another application of RFID technology is the electronic identification tag you can have placed under your pet’s skin. A third common application is security access badges. For applications where little harm can come of the data being transmitted, RFID is a great technology. For applications requiring security of the data carried, there is much debate.

An article from The Register explains just how insecure some of these RFID credit cards are. The article details the findings of University of Massachusetts professor and RFID Consortium for Security and Privacy (RFID-CUSP) member, Kevin Fu. Fu tested 20 credit cards from all of the major issuing companies, and found some discouraging results. Fu found that while many credit card companys claim to use “encryption,” most did not actually encrypt the data on the card. He also found that the data could be read from a “few feet” away. This would make it easy for a hacker to walk through a crowd or sit by a door and sniff credit card information from the unsuspecting consumers that happened to pass. According to the article, the equipment for launching this type of attack could be had for as little as $150.

You may think that this use of RFID technology for transmitting sensitive data is limited to the credit card companies, but you’d be wrong. The United States government is issuing passports with embedded RFID chips in them as well. The scary thing is that these documents contain more private information than credit cards (like a digital image, etc.), and the government appears to be aware of the problem of unauthorized “snoopers” (they put a thin metal layer in the cover of the passport to try and prevent this). They are called “e-passports”, in case you are wondering, and, in my opinion, you should stay away from them as well.

There are steps that can be taken to minimize the risk of your credit card information being stolen, like wallets and passport cases specifically designed to block RFID signals. According to one poster on Slashdot, you can microwave the credit card for 3 to 5 seconds to destroy the RFID chip without damaging the magnetic strip. However, the easiest way by far of protecting yourself is to not allow them to store your private, sensitive data.

There are arguments on both sides, of course, but the fact of the matter is that there is still a great deal of uncertainty about the security of using RFID devices to transmit sensitive data. It may be that the practice is perfectly safe, but I seriously doubt it. I for one will not be using an RFID credit card or passport any time soon. I’ll wait for the version that makes it impossible for someone to gain unauthorized access to my sensitive information.

E.