Germans are so scared of surveillance they microwave their ID cards | Hacker News Reader

Germans are so scared of surveillance they microwave their ID cards

washingtonpost.com

54 pointsLibertatea53 comments

To be precise it's not only our ID cards that we like to microwave but above all our passports.

The reason is that 2005 a new generation of passports was introduced, which contain RFID chips that can be read out wirelessly over a distance of a few centimeter (or in some cases even a few meters). In the beginning, these chips only contained a digital version of the information on the passport, i.e. the name, passport ID and photo. However, since 2007 the chips also contain the digitized fingerprints of the passport holder. Various organizations such as the Chaos Computer Club showed how easy it was to access that information and demonstrated that such access could even be done unknowingly to the passport owner, e.g. when walking by a (hidden) reading device with your passport in your pocket. So, quite a nightmare from a privacy perspective.

Back to the microwaving: While it is required to have a valid traveling passport if you wanna go abroad (i.e. outside the EU), it is NOT (yet) required to have a passport with a working RFID chip. Simply putting your passport into your microwave oven for a few seconds will irreversibly destroy the RFID chip while leaving the passport intact => Privacy problem solved :)

So the next time someone tells you that Germans are not very pragmatic or too obedient just tell them that we are microwaving our passports ;)

(I edited the first line to reflect the fact that they primarily talk about ID cards in the article, thanks to _more_original for pointing this out)

> To be precise it's not our ID cards that we like to microwave but our (travel) passports.

No, this article is about ID cards. The new ID cards, introduced a few years ago, also have RFID chips.

https://en.wikipedia.org/wiki/German_identity_card

I think they might have gotten it wrong in the article, since travel passports are a much bigger problem than ID cards (which also contain RFID chips), because the former contain more sensitive information. In particular, storing fingerprint information is optional (i.e. decidable by the card holder) for the ID card but mandatory for the travel passport.

Don't know if he changed his comment, but your cite is missing the word 'only'.

yeah I edited it.

Concerning the legality of destroying the RFID chip: The article mentions that one person was arrested in Frankfurt airport when officials detected that he had microwaved his passport (or ID card), and that he would possibly be facing jail time for tampering with official travel documents.

In my legal opinion, while your passport is property of the Federal Republic of Germany and thus not yours to do with as you please, it is a big difference if you willingly try to alter the information on the passport, or if you destroy part of the digital information in the passport. While the former might be considered a crime it is hard to imagine that the latter would be punishable by more than a small fine.

User dao- notes that the original source[0] says they weren't arrested, only provided with a temporary replacement and their damaged id confiscated.

[0] http://www.faz.net/aktuell/rhein-main/mann-erhitzt-personala...

Simply putting your passport into your microwave oven for a few seconds will irreversibly destroy the RFID chip while leaving the passport intact => Privacy problem solved

Don't passports remain the property of the issuing state in most cases? I'd be concerned that deliberately altering it and attempting to travel could be a legal problem.

Yes that's indeed true, see my comment above.

What is the effectiveness of RFID shields? Tampering with the passport is really a nono.

That's also an option and there are some commercial providers, e.g. this one:

http://www.pointprotect.de/

There's an old, but fairly comprehensive, consumer report article from 2011 that concludes: "When Recursion’s security experts tested 10 types of shields and wallets currently being sold to protect contactless cards, they found that none blocked the signal completely, and there was dramatic variability even among samples of the same brand."

I don't know if the situation has improved much since then.

> they found that none blocked the signal completely

You can not block ths signal completeley. It is just the nature of radio wave that some small amplitude will get past the barrier, but you can lower the signal-amplitude so much, that the signal is worthless and a passive rfid chip will never respond.

Alas, with a very strong sender, you might get through, but that is more a theoretical possibility or for the truly paranoid.

To be fair, allowing the arbitrary and (practically) undetectable leaking of fingerprints is also a no-no.

I think you leave your fingerprint at more places than your passport number anyway.

Yes, but you don't also leave your name and other identifiers behind, just the prints.

Sure but, as redblacktree points out, you usually don't leave it behind in conjunction with your passport data.

Also, with RFID you give an attacker more options for gathering more data without anyone noticing. For example at the entrance to an airport you might gather hundreds of identities per hour.

I use them for all my credit/ID/etc. cards now. They should lower the maximal distance for reading so that someone has to be super close to your card to read anything. It's not 100% but for practical purposes should be sufficient (e.g. rogue RFID reader at the airport reading all passing by cards from 1m distance etc.)

Very good. I made some tests, back when I was at the university. We had a Hardware Lab with Radio-Test Equipment and RFID Readers/Writers.

I have this one:

https://shop.digitalcourage.de/thema/stoprfid/rfid-nfc-myfar...

It just works. The Signal/Noise-Ratio and amplitude of the RFID-Signal (in the casing) is just too small, to trigger a rfid response.

What material is actually used in your linked shield for "Schnüffel-Chips" [fantastic word!] ? Is it just foil lined or is there a mesh, what material is the mesh and what pitch?

I'd imagine you could have an active mask too [eg just a RFID with false data] that would return some signal just not the one being sought.

I don't know what material it is exactly but it is a mesh, and suprisingly thin and flexible.

Your idea of an active fake-chip is really nice, it could actually work (on non-encrypted content).

Alternative solution to the finger print problem:

http://jacquesmattheij.com/the-belt-sander-and-the-battle-fo...

That way you don't have to nuke your passport, it simply makes sure there are no prints on it in the first place and for a bonus it also makes sure that the local municipality (which wouldn't know a database breach if they were hit over the head with it) doesn't have them.

Is the idea to temporarily remove the prints just before applying for ID or is the process more permanent?

Just before. It takes a few weeks to months before they grow back identical to what they were before.

Note that there are ways to remove fingerprints entirely.

Nasty ones, mind you.

"On Tuesday, a 29-year old man was arrested at Frankfurt Airport after authorities noticed that he had microwaved his German identification card"

No he wasn't. The source (http://www.faz.net/aktuell/rhein-main/mann-erhitzt-personala...) linked to from the article says police confiscated the damaged ID card and gave the man a temporary replacement, and he could continue his travel.

Yet another glitch in this rather poor article. (Others have already pointed out other flaws that I won't repeat.)

The casual xenophobia in this headline and article are crazy. Really, "Germans are so scared...", "Germans can’t take a joke."?? We must have a little more nuanced view of the situation than that - just because there is a group of people doing something in a certain country doesn't mean that we should push the message that it is representative of the whole population. Wow.

Yep, thats about it, besides some hackers and hipsters, I don't know people over here who would even consider this. FYI, I didn't do it, I have a metal casing, that works as a faradays cage, to counter unwanted RFID emissions.

Well, and they've got every reason to be. The NSA and American airport security theatre made the world a place where microwaving your ID card actually makes a lot of sense.

> sales of old-school typewriters were reported to have skyrocketed

That's awful journalism and hearsay at best. Typewriter sales didn't skyrocket. Some authorities, notably services related to government and parliament bought some typewriters after the NSA breach and the most recent parliament security breach because they just couldn't trust their digital equipment anymore.

Typewriter sales didn't skyrocket.

If you dig back through the sources to the original quote you'll also find this further quote from the same salesperson of a typewriter company talking about their sales number:

"We’ve seen an increase because Brother left the market"

So he only said their sales went up, not the total demand for typewriters, and while he had seen some increased orders from various defense and security services, he attributed it largely to one of their biggest competitor leaving the market.

I also wonder how much the hipster movement has contributed to the increased sales in typewriters?

Deutschland: Das Land der Dichter, Denker und Paranoiden.

The article is a bit overblown, we are not really that scared. Actually most people don't care or even understand the implications. But privacy is a very big and deep-rooted thing.

These German microwave shenanigans are around for quite some time, but i haven't met one single person that microwaved ids or passports.

Yes, most of the people don't scare.

Some days ago i need a new Travel Passport and i felt not good when they want my fingerprint. It feel like you are a criminal.

Did not know until now that microwave can destroy the chip, but i will think about it.

I am not paranoid, but I did not see any advantage or higher security with my saved fingerprint.

Since you're referring to the Dichter & Denker trope: that was originally about Germany having no copyright in the 18th century, so access to the works of the poets and philosophs was affordable and widespread.

So it doesn't refer to lots of poets and philosophs (Germany was probably below average) but to the wide distribution of their writing.

(my favorite anecdote from that time: Goethe, at some point, cited his own works. Since he didn't lug all that stuff around he worked from a copy he bought. Unfortunately it was an unauthorized copy containing modifications, which he didn't notice - and copied into his citation)

More like incredibly pissed and disillusioned than scared (in the US-meaning, not UK-meaning of 'pissed'). The article reads like us Germans are a bunch of tin-hat weirdos, and indeed, pre-Snowden I would have agreed and laughed at these silly people who think they're watched at every step, it's all just conspiracy theories right, it's all over since 1990, the secret service has no longer power over people etc etc etc?

Post-Snowden is an entirely different world, and I feel like the last 25 years were for nothing. The worst and silliest conspiracy theories turned out to be indeed true. The 'Free West' which was such a powerful and wonderful vision for the East German youth turned out to be just another variation of a surveillance state, just with a prettier paint-job.

So yeah, I'm incredibly pissed at the German and US governments and the secret services. The sad thing is that nothing at all would change with a different government.

[edit: typos]

One can learn a lot from people that had suffered nazis and stasi not so long ago.

In 2010, a governmental survey came to the conclusion that it would “take ten years for the document to establish itself.”

This is because they have a validity of 10 years, nothing security related.

In the future, I think it's far more likely that the US or UK will have a really horrible government, than Germany. Because the US and UK governments have been pretty good for such a long time, most people in those countries are not aware of the importance of privacy. And when the horrible government comes along, there will already be plenty of surveillance in place that it can use to tyrannize people.

> "online formulas"

I'm guessing this was translated from German or something; isn't form "Formular" in German?

It is.

It's unclear to me why there needs to be any biometric information at all, on an ID card for use in a modern country like Germany. A chip-and-pin card with a ID number on it and your name (the latter simply so that you don't mix up your card with that from someone else). All the rest goes in a database.

The police can look up your "Virtual ID card" based on your ID number or from other information (a fingerprint, retina scan, name, etc.). Non-security institutions (other government agencies, a bank, whoever) do so only with your permission... you put your card into a smart reader, confirm with your pin, and your "virtual ID card" is shown to the person confirming your identity.

All access to the system is logged (including the police) so that the user can see who's pulled up his info.

Yeah, and Americans are fat gun-wielding christians.

well, many of them are, just not all :) not that there is anything wrong with gun wielding, or being christian (nobody is perfect after all), that fat aspect not so much

How did difficult to assail ideas like Freedom of Speech come about?

I mean, speech can obviously be dangerous, lead to actions, incite, etc. But, unlikeable speech will garner some support when repressed because freedom of speech must be preserved.

When it comes to surveillance and a lot of other liberty relevant stuff, we don't seem to be able to draw lines. Regulations, promises and policies seem to be enough "as long is it doesn't get into the wrong hands."

What we end up with is a predictable immediate slide. Surveillance laws enacted to allow authorities to pursue terrorists are used in general policing. Financial restrictions enacted to fight organized crime, and "money laundering" end up restricting financial freedoms of anyone getting caught up in the "risk review" dragnet and being denied basic financial services.

Anyway, Germany and their living memory of the Stazi is a potential flag bearer for the freedoms that we are losing quickly.

Let me fix that headline: "a few hundred Germans are so scared of surveillance they microwave their passports".

And if millions know that microwaving destroy the chip but the passport is still usable... did you still think it will be only "a few hundred" ?

Yes. Well, maybe a few thousand.

if you actually use it for travel, sooner or later it will be revealed by some security wanting to scan your malfunctioning passport. By fixing one problem you create another

Why not put it into a Faraday cage?

This is actually a good point.

Rather than putting your ID card or passport in a microwave (and breaking the law), you could just use an RFID-blocking wallet or passport holder.

Like everything sold on https://shop.digitalcourage.de/thema/stoprfid/ (the 'support shop' of an organization doing privacy advocacy)

Because you still, presumably, need to take it out of the Faraday cage to use it.

"scared of" is not an acceptable synonym of "opposed to".

I mean those silly Germans - they just can't take a joke about their own government as well as their partner, the U.S., spying on them and then using that information for their own economic interests or other more malicious reasons.

Lighten up!

Reply on news.ycombinator.com