Hacker News Reader

Comment by woodrowbarlow | Hacker News Reader

this is tangential, but: the chips mentioned in the first section of the article are simple RFID tags, similar to the chip a vet might implant in your pet cat. they aren't GPS receivers, they aren't internet-connected, they don't even have a battery. they just store a key which is insignificant without the context of a larger system. i've seriously considering getting one of my own (to pair with smart locks or my car's ignition). i'm very privacy-conscious when it comes to technology, and people who know me are always shocked to hear me express interest.

there's a lot of unwarranted FUD surrounding implantable RFID.

View on HN

On that note though, while you up the convienence, you also lower the security. Passive RFID can only broadcast a number; there's no compute to adhere to any sort of security protocol that is resistant to replay attacks. Meaning anyone with a reader that passes close enough to you will have the keys to your house.

"Hey, can you take a picture of me and my friend?"

Later: "My phone got his RFID. Let's clean him out."

Parent said simple, not passive. Non-passive RFID is still simple.

From parent, "they don't even have a battery". Maybe my definition is off, but doesn't that mean passive? I.e., requires an antenna to activate it via an RF discharge, and then with that minimal charge it broadcasts back its identifier.

you're right, i did mean passive. something like [1]. i don't claim that they are a particularly secure solution. i only wanted to dispute the implication that they enable GPS tracking.

[1] https://dangerousthings.com/shop/xm1-plus/

> Passive RFID can only broadcast a number

Nope, not anymore. Current UHF RFID tags are able to store enough charge from the RF signal from the reader to have a half-duplex conversation with the reader and do small amounts of computation. See https://www.iso.org/obp/ui/#iso:std:iso-iec:18000:-63:ed-2:v...

Cool! Has anyone shown that a subdermal sized RFID chip is able to adhere to that? Further, does any RFID chip on the market have a real security story? Ideally you'd have public/private key encryption with some programmability on the part of both the readers and the chips themselves (so readers can be told "here's the public key of ID#1234, so only trust that you've seen 1234 if you get something decryptable with this key", so they can't be easily spoofed, and RFID chips can be told "here's the public key of the reader(s) you should respond to; anyone else ignore").

Until that happens, I just don't see it being secure.

> Further, does any RFID chip on the market have a real security story?

A few minutes of Googling would have told you that, yes, such things already exist and have for a while. Slap one into a implantable tag and you're done.

Obviously these do enable tracking because they can be detected at different locations, just like your phone can be tracked as it travels along a store if can be distinguished by its Bluetooth or Wi-Fi MAC address.

And just because the reader in a door lock only responds to a nearby tag doesn’t mean they aren’t detectable from further away if the antennas are bigger.

you're right, i've edited that claim out. larger systems utilizing RFID can enable tracking; however, the implant itself isn't inherently privacy-averse.

It’s just as privacy averse as tattooing a barcode on your face. Both allow you to be tracked wherever you go. The only difference is that a tattoo is visible to the naked eye.

... which is just as privacy-averse as having facial features which are visually distinguishable from other peoples' facial features, right?

i apologize for the sarcastic example, but the point i was originally trying to make is just that media doesn't understand implantable RFID and constantly implies that if you get a chip you'll end up in a government database with constantly refreshing latitude and longitude.

Facial features cannot be distinguished as exactly and easily as a barcode or RFID tag but they are indeed hard to hide.

But if everyone gets an RFID tag you can be sure their locations end up in a big database the government can track, either because companies roll over each other in their efforts of covering the world with readers or the government placing them itself. Just like the database that records the tower your cell phone is connected to, all the time and basically forever. And you can be sure governments aren’t keeping their hands off that kind of data, they’ll find a reason why they need it.

As soon as you walk by someone or shake someones hand, they can copy your implanted RFID. Now, if you want to 'change the locks' to your house and car, you will need to dig out the chip in your hand and implant a new one.

To me, adding the capability to a watch, fitbit or other such wrist wearable is the far more practical option. Easy to change out if it gets compromised, plus you can build in a switch so that it is only capable of broadcasting when you press a button.

You're only thinking from a security standpoint. It's valid, but there can be other goals for the system. You can take off a watch to leave at your desk. You probably don't want to chop off a finger.

they don't enable tracking of any sort.

I wouldn't say that. They enable tracking much like a credit/debit card; they provide an unique ID that can be logged by the reading device when you use it.

Detecting proximity to a reader is tracking of a sort.

you're right, i spoke too broadly. systems utilizing RFID can be designed to enable tracking, but RFID implants themselves are not inherently privacy-averse.

if i set up a system at home, my implant would be useless in the context of any other system. i am not at risk of being tracked by unknown parties simply by virtue of having an implanted RFID chip.

If a few inches of fake fur[1] is enough to block it, I don't see how it can be tracked at a distance.

[1] (the video is loud) https://twitter.com/The_Sass_Hole/status/982519966225305600

There's no reason to assume the reader there is the best possible reader.

It might even be intentionally rejecting weak signals.

Reply on news.ycombinator.com