Why repair when you can litigate?

It seems to be pretty commonly accepted right now that RFID chips (small chips using radio waves to identify themselves to a supposedly nearby scanner) are hopelessly insecure and easily duplicated. This technology may be in a few things you own, such as some smart credit cards, student ID cards, and now all new passports in the US, UK and other countries. It has been demonstrated before that a bunch of cheap Radio Shack electronics can scan/record an RFID chip froi a short range while you carry it in your pocket. Thus without the need to actualy have physical access to the item, you can possibly be identified, or "copied".

But like the multitude of potential security breaches raised against voting machines, the best approach by the companies involved seems to be to keep concealing their code, and threaten or press release your way out of the public's attention span. Marketing budgets are bigger than tech budgets it seems.

The most recent example of this is the threat from manufacturer HID Global (a name that seems unfortunately close to a well known disease?) to a bloke intending to demonstrate the insecure nature of RFIDs at a very well known hacker conference in CA. The legal threat was that he is infringing their patents by building a home made scanner that can clone their RFID.

I can understand the easy validation that he is showing people how to do something bad, but in this day and age of global communications, youtube instructional videos, and searchable knowledge via your "series of tubes", does anyone still believe that concealing such things makes an insecure system more secure?

The best comment in the Wired article was this one:

"I'm sure burglars, identity thieves and others who misuse insecure RFIDs for personal gain will be deterred by the years of messy patent litigation they'll face if they start hacking RFIDs."

This somehow reminds me of DRM. Most DRM systems, designed to generate more money for distributors from the same content, seem to function primarily by making it harder for legitimate purchasers of music/content to transport it as they wish (e.g. download on PC, burn to disk, play in DVD player, add to iPod). But all the while it fails to stop the thieves who are really hell bent on misusing it, through large-scale duplication and resale.

We generally good citizens understand the need for such things, but are the implementations really serving the people it is intended for, or hindering/exposing them to uncessary risk for the sake of new business contracts?

You Shall Not Pass

Wired contributing writer, Bruce Schneier wrote a great overview about the recent melee over the PhD student who put up a website that allowed you to generate a fake boarding pass, exposing the security issue you have probably pondered once or twice ever since you started printing your passes online.

This is another classic heavy-handed authority knee-jerk reaction: leap on the symptom, ignore the problem. You can read all about the FBI and other (vote seeking) public official reactions on the guys blog here.

Schneier's article covers some ground concerning the safety measures airlines oppose (any that might cost them), and a surprising fact about why they encouraged identification checks at airport security checkpoints.