Mythbusters Silenced by Credit Card Companies

[Ehtyar]

A Mythbusters episode entailing an analysis of RFID tags (and how easily they're hacked) has been trodden on by "American Express, Visa, Discover, and everybody else...".

Although it's no secret that RFID is easily hacked (see: train passes, passports, credit cards, one billion other cards, etc.) it's still not necessarily common knowledge, and it sounds like the major credit card companies want to keep it that way -- according to Adam Savage, Mythbusters was all set to do a show exposing the weak security behind most RFID implementations but was shut down by lawyers from "American Express, Visa, Discover, and everybody else... [who] absolutely made it really clear to Discovery that they were not going to air this episode." Since Discovery is an ad-supported channel, it's not surprising that it backed down, but we'd say that the credit card industry would be far better served spending money on actually improving security rather than lawyering up and trying to keep consumers in the dark.

Full Story

Ehtyar.

[Eóin]

I'm surprised by Discovery backing down, but at least controversy like this means the story will get more publicity than it could ever have hoped for.

[Ehtyar]

I imagine the first happened in order to lessen the effect of the second.

Ehtyar.

[f0dder]

Bastards.

[Darwin]

I'm surprised by Discovery backing down, but at least controversy like this means the story will get more publicity than it could ever have hoped for.

I hope you're right. This is quite frightening and really needs to be addressed. We've got people talking in general terms about RFID (as implanted in credit cards, cell phones, car key remote fobs, etc.) being used to identify us and our shopping habits/preferences and stream targeted advertising to us in stores so the technology either needs to be made much more secure or scrapped. Right now there is a lot of excitement over it so I doubt that it's going to be scrapped...

[kartal]

If you have time


http://itc.conversationsnetwork.org/shows/detail210.html

RFID -- Radio Frequency Identification -- is transforming the way companies track inventory, artwork and even law briefs, but some fear it could be used for more "Orwellian" pursuits. A panel of leading technology developers and pioneer end-user corporations explores this promising and yet maligned emerging technology that both empowers consumers and raises privacy issues.

[Darwin]

Bastards.

Well said. Exactly how I feel. Once again profits trump public safety. Identity theft made possible at this level is a public safety issue and ignoring it while making billions off it is immoral. Hold on... This is eerily familiar, isn't it?

[Darwin]

If you have time


http://itc.conversationsnetwork.org/shows/detail210.html

RFID -- Radio Frequency Identification -- is transforming the way companies track inventory, artwork and even law briefs, but some fear it could be used for more "Orwellian" pursuits. A panel of leading technology developers and pioneer end-user corporations explores this promising and yet maligned emerging technology that both empowers consumers and raises privacy issues.

I'm going to have to hunting for this, but there was a Danish graduate student who invented some sort of a "firewall" to protect against this... Read about it a year or two ago. I'll post a link when I can find it.

EDIT: That was easier than I thought, though it's not the same article I read back then: http://arstechnica.com/articles/culture/rfid-guardian.ars

[zridling]

Reminds me of Diebold Corporation's idiotic resolve not to release their buggy voting machine code, which conveniently dropped tens of thousands of votes in key districts every election.

[Renegade]

Bastards.

Well said. Exactly how I feel. Once again profits trump public safety. Identity theft made possible at this level is a public safety issue and ignoring it while making billions off it is immoral. Hold on... This is eerily familiar, isn't it?

+1000

I can't post more without resorting to an extreme rant filled with profanity.

[Josh]

Just blame mouser, he is at fault for it all

[housetier]

This just makes me feel good for not using nor even OWNING a credit card.

[tomos]

This just makes me feel good for not using nor even OWNING a credit card.

that's easier in germany all right - but some places it's very difficult to buy anything online without cc

oh no my new avatar is kindof/very like yours housetier - take it as flattery

[f0dder]

This just makes me feel good for not using nor even OWNING a credit card.

You do own a debit card, though, don't you? I'd feel handicapped without one. Oh, and in .dk, many people generally call both debit & credit cards "kreditkort". Wasn't until ~5 years ago I realized what a credit card really is, and how awful an idea they are.

[housetier]

I don't have a debit card either. I always pay cash

[f0dder]

I don't have a debit card either. I always pay cash

Wow

That'd be way too inconvenient for me - it's very rare that I carry cash. And when I do, it's usually because I'm "up to no good"

[Armando]

I don't have a debit card either. I always pay cash

Nowadays, when you have to travel, it's almost impossible to not have a credit card. Need to rent a car ? Need some more cash but your debit card won't work in that country ? And here in Canada -- but I'm pretty sure that it's the same almost everywhere -- having a credit card allows one to build a good (or bad...) credit report and score... Handy if you need/want to buy a house or anything like that.

[alivingspirit]

This just makes me feel good for not using nor even OWNING a credit card.

that's easier in germany all right - but some places it's very difficult to buy anything online without cc

Shouldn't be to hard. Sign up for a virtual card.
http://www2.discovercard.com/deskshop/?icmpgn=200512_dc_bn_hu_napnap_sec_nap_soa_1

Or use paypal.

[40hz]

I suspect the card companies mostly wanted to hide how poorly conceived and implemented the whole RFID thing is. Because the big secret here is that there isn't any secret to it.

Unfortunately, all the info needed to perform the hack is readily available via a simple Google search. And anybody with the minimal technical acumen to pull it off already knows that. I doubt even the script-kiddies watch MythBusters for computer hacks.

The terrifyingly 'nordic' Xeni Jardin even has a vid up on Boing-boing showing it in action. There are no details presented. But I'd guess most of the crowd here at DC could glean enough from just seeing this interview to figure out the rest.:

http://tv.boingboing.net/2008/03/19/how-to-hack-an-rfide.html

There's a great observation made during the interview about how RFID pushes the decryption of sensitive information out of a secure corporate data center and on to some merchant's card reader. Love it!

[Ehtyar]

Can anyone say scaaaaaaaaareh!!

Ehtyar.

[Renegade]

The credit card companies are seriously incompetent. They really piss me off too, because as a merchant, I end up paying for their mistakes! 

RFID is just another way for them to be idiots and screw their customers without taking responsibility.

[Ehtyar]

The credit card companies are seriously incompetent. They really piss me off too, because as a merchant, I end up paying for their mistakes! 

RFID is just another way for them to be idiots and screw their customers without taking responsibility.

Very very true, I've seen it also.

Ehtyar.

[housetier]

... having a credit card allows one to build a good (or bad...) credit report and score...

It also allows for the opposite: build a very bad credit record. so bad in fact one can't even sign up with an ISP or phone company, much less rent an apartment.

I have been burnt by credit cards and can only say: ask yourself if you really have the money (i.e. is it really yours) are going to spend with it.

[Armando]

True.
I never use my credit card to spend money I don't have. When money becomes scarce, I re-budget, I find ways to  spend less, etc., I'll even borrow (friends, parents...)... But I will usually not use my credit cards. Of course, context and mileage may vary...

[Deozaan]

I just got my passport and it also has RFID in it.