Who needs a million NFC tags?

Someone is planning a big slash into the Near Field market, bundling more than a million NFC tags with handsets over the next six months, according to tag supplier Identive. The company has announced the order, placed by a "leading mobile handset manufacturer" which will put them into phone boxes to "enhance consumers' day-to- …

[LesC]

Do you want fries with that?

Am I the only one that thought they were going into telephone boxes? You could cram a lot of phone numbers for, um, Vietnamese masseuses or dominatrixes on one of these devices, one swipe and you're sorted. Saves all that hassle with collecting postcards, too.

Mines is the one with the Nexus S in the pocket.

[Anonymous Coward]

Are you sure...

I reckon yours is more likely to be the mucky trenchcoat with the Nexus S in the pocket.

[Anonymous Coward]

Range

What is the range of this NFC tech? Is it like passports which can only be read at very close range (for relative values of "quite a distance" given the correct kit)?

Is it possible to use the NFC tech for tracking (a la RDIF)?

Can I disable (either by hardware or software) the NFC capabilities, or would I need to have some pouch/shield to block the signals?

How long will it be before people can take payments, without the owner's knowledge, using this tech? And what avenues of appeal do people have for potentially fraudulent transactions?

[Peter Spreadborough]

Re: Range?

The clue is in the name....NFC Near Field Communication. (up to about 10cm)

[Anonymous Coward]

@Peter

Nyes...RFID was meant to be "near" as well, but with the right kit they can be probed tens of metres away; one just needs to send a big enough pulse to give the chip enough power to respond over the desired distance. Search El Reg for the various stories about passports.

So the question stands. Is there some physical aspect or design feature that prevents them from being probed from afar?

Just because the marketing droids call something "near..." or "secure..." doesn't mean it is.

[Dave N]

What the f**k is the Internet?

Try typing NFC into Google, and prepare to be amazed.

[Anonymous Coward]

@Dave

Yes, and it may surprise you to know that I have looked. Everywhere quotes "near" but there is no detailed explanation I can find that states why. So rather than being a forum troll, how about being a bit helpful?

Can't be helpful? Then stay quiet.

[Dave N]

@anonymous coward

Try "NFC distance" - first hit. Was that so hard? Idiot.

[Tom 35]

First hit...

"Theoretical working distance with compact standard antennas: up to 20 cm (practical working distance of about 4 centimetres)"

Note: "compact standard antennas". So that is still not an answer to the question can they be read from a distance with the right gear (larger non-standard antenna) like RFID?

Assuming that your first hit is the same as my first hit - Wikipedia (not a great assumption I think, and not the most trusted source).

[Anonymous Coward]

@Dave

Dave, a few things:

1) My search result in Google may not match yours;

2) Google may not be my choice of search engine;

3a) Wikipedia (my first result) merely states various ranges with zero explanation of *why* the range is so short.

3b) It might be simply the power of the RF initiator that controls range; if the RF initiator power is increased does that increase range as with RFID or is there some other limiting factor? For example, is the short range caused by air attenuation due to the specific frequency chosen?

3c) The question still remains unanswered.

4) I have neither attacked nor insulted you yet you feel it is OK to do the same to me. In fact, you feel it is OK to throw insults regarding my intelligence when you clearly have not managed to understand the question being asked. So please, remain quiet if you cannot answer the question, or polite at the very least.

[142]

One per robot?

...just making an observation...

[Anonymous Coward]

Or....

One per meatsack(human) slave, installed painfully by our robotic overlords?

[Anonymous Coward]

Barcodes are better

Why waste even a few minor currency units on a single use NFC tag when laser etching a barcode is simpler and more cost effective?

And can still be read after an emp.....

[John Riddoch]

HTC or Samsung, probably...

We're almost certainly looking at an Android device and it would have to be one of the higher-end models to make it work. I doubt Google would be looking to sell another million handsets given the hassles of the Nexus models, so we're looking at a 3rd party. HTC and Samsung are probably the biggest sellers of Android phones with models like the Desire and X10 doing well.

I suspect Samsung are in the lead on this as they developed the Nexus S (with NFC) alongside Google so already have experience of building NFC phones.

As was said, Apple are unlikely due to the smaller numbers; WinMo might be an option at a push if Windows/Nokia try to find themselves a key selling point. Arguably, the finance industry might be more willing to back a Microsoft initiative over a Google initiative for NFC.

[Jedit]

Samsung

The noise is that the US version of the Galaxy SII will be NFC-enabled.

[KjetilS]

Google?

My initial thought was that this was something Google could have done. Even if the order itself came from a "leading mobile handset manufacturer", it could easily be Samsung or HTC acting on behalf of Google.

I don't have any evidence at all to back up my, admittedly wild, guess, but it is the kind of company that would actually throw around freebies just to see what happens.

... or maybe they are planning on world domination through NFC :P

[TeeCee]

So it's Nokia then.

The answer's in the article:

"Nokia has shown how NFC.......<etc>".

Now, the only problem is that your speakers and telly don't have an NFC tag in 'em for the phone to recognise and make this work. So, open box, stick tag marked "Audio" onto HiFi streamer, stick tag marked "Video" onto telly[1]. First wave at tag causes the streaming app to open and search for DLNA devices, pick the one you just tagged for that function and you're sorted from then on.

Simples and coming soon to a Nokia / WinPho[2] launch near you.

[1] Sensible people will ignore the instructions and stick the tags somewhere within easy waving distance of the sofa, so they don't have to get up and walk over to the bloody things.

[2] Unnecessary (but irresistable) cheap shot: This is why, even giving away two with each unit, they only need a million of the things......

[stucs201]

Suggested application

Use proximity of the tag to trigger a wipe and reset of the phone. Why? So your personal information is protected when you eventually put the phone back in the box to flog on ebay - lets face it still in the box is where these tags are most likely to be.

[Ian Stephenson]

Once we know who has bought them

Those of us who don't want NFC can avoid them.

[K. Adams]

Soon I'll be Faradayed to Hell and back...

Sheesh!

We've already gotten to the point that we need to start carrying our bank cards, passports, and such in metal-mesh-lined wallets.

Now you're telling me I'll need a Faraday holster for my smartphone, too...?

Oh, wait...

[Some Beggar]

@K. Adams

Can you explain what you think the risk is to your identity and your cash with these near field technologies?

The last report I saw on RFID passports suggested that the technical hurdles meant it remained far less of a risk than physical theft of passports. And NFC payment cards are more secure (shorter range and higher security) than passport RFID. They're also not vulnerable to sniffing since the information that is passed between payer and payee isn't particularly useful. An electronic pickpocket would effectively need to be a walking virtual cash register with an account set up with the payment scheme in order to skim off your cash.

I'm not suggesting there is no risk at all. I just wonder why you think it is such a risk that you should start dressing your belongings in tin foil hats.

[K. Adams]

"Can I explain what I think the risk is...?"

The risk depends on the mode of attack, and the modulation and encoding used to transfer the data:

-- -- Wikipedia: Near Field Communications ("Security aspects" section)

-- -- -- -- http://en.wikipedia.org/wiki/Near_Field_Communication#Security_aspects

That said, no RF-based transaction system is immune to eavesdropping at a distance (Van Eck phreaking):

-- -- Wikipedia: Van Eck phreaking

-- -- -- -- http://en.wikipedia.org/wiki/Van_Eck_phreaking

Whether the collected data itself is useful is another matter: If strong encryption was **properly** used to secure the transaction, then the risk would be very low; however, we have seen fairly often how strong encryption is only properly implemented after something bad happens that gets people's attention.

[Some Beggar]

@K Adams

I'm not really sure how any of those links are supposed to answer my original question. I'm aware that wireless technology is insecure at a fairly fundamental level. But I was asking what specific threat you think exists in NFC payment systems that warrants wrapping them up in tin foil.

A pickpocket posing as a cash register simply isn't a realistic threat.

[Mage]

Really?

What's a phone box?

A box that a new mobile phone comes in or the Public Urinals that used to have phones in them?

My coat is the one with a phone in the pocket.

[Robert Ramsay]

Run for your lives!

It's Kevin Warwick!

[Anonymous Coward]

Made my first NFC payment at the weekend...

McDonald's + Barclaycard --> BEEP.

Sorted; didn't even have to touch the PIN pad.

Up with this sort of thing.

Now when can I buy the Samsung Galaxy S II with NFC (i9110)?

[Circadian]

please finish your name...

..."Your Retarded". Your retarded what? Your retarded uncle/nephew/aunt/hamster? Pedants want to know...

Still - seems an appropriate moniker for someone enjoying NFC :-)

[Anonymous Coward]

Not my retarded

I am Your Retarded.

For the people.

[Circadian]

Debate...

...seems worthless with someone who thinks:

"I am Your Retarded.

"For the people."

makes any kind of sense.

My main concern is how easy it is to "skim" small amounts with this. 50p here, a pound there, it will all add up. And what chance do you have of disputing any amount that gets charged? Evidence from chip and pin is that the banks will insist that their security is wonderful, and it is up to you to prove that you were defrauded.

I wonder how long it will be before we find out how easily it will be scammed, and how many people get stung for how much. Still, glad to have canaries like you out there to test out how well the new stuff works!

[Anonymous Coward]

To take payments one requires a merchant account.

As in, you need to be approved by a merchant bank who check that you are a legitimate business and you have an address. If you go around "skimming" money off people willy-nilly the cops are going to come knocking pretty soon.

Like I said,

you haven't really thought it through much, have you?

[Anonymous Coward]

Why would one not enjoy NFC?

The only objections I have come across - after extensive research - are solely based on FUD.

I would be most interested to discuss any concerns that can't be easily tackled by a few minutes of applying brain.

[Anonymous Coward]

@Your Retarded

Same reason some people don't enjoy credit cards, a lack of control?

Also, for some things, one may elect to pay in case to obfuscate traceability.

[Some Beggar]

"obfuscate traceability"

This is genuinely the most hilarious thing I have read on the internet this week.

You're not Jason Bourne. Really.

[dogged]

Not Jason Bourne

Well no, but say you wanted to get the other half a birthday present or something and for some reason (sales, maybe?) you wanted to buy it well in advance. On a joint account, cash is the way forward.

[Anonymous Coward]

Good for you.

How easy would it be for the guy behind you to nick your card and use it to buy their lunch at Mc Donald's as well?

I'd guess that it's just as easy as nicking all the cash in your wallet.

That's before you consider all the really fun ways for an attacker to take money from a NFC card, and the possibilities for 'accidental' overcharging - that you would not find out about until your statement.

It's a giant leap backwards in security - and rather appears to be a way for banks to wiggle out of compensating you for fraudulent transactions.

If somebody nicks that card, they can do the same as you just did. And you can't stop them until you've noticed the card is missing, found a telephone and called your bank. During all that time they're racking up charges that you're going to have trouble getting back from the bank - if you can at all, given the recent changes to various T&Cs.

If I were you, I'd ask them exactly what your risk is - what would they refund you, and under what circumstances?

That gets even worse if the NFC card is your phone, as that makes it slightly more difficult to call your bank if it gets nicked.

These contactless cards seem to have a transaction limit of £15 or so, and a daily cap of £50.

So basically, you're now carrying about £50 'virtual' cash at all times every single day, in addition to whatever physical cash you've got in that wallet.

I don't know about you, but I don't tend to carry that much cash around with me on a normal day and I rather like being able to vary my 'risk' depending on what I'm doing and where I'm going.

[Some Beggar]

"I don't tend to carry that much cash around with me on a normal day"

So don't carry an NFC payment card either.

(c)Trivial Solutions to Trivial Paranoia Ltd.

[Some Beggar]

@ac 11.11

You still haven't explained _how_ the guy behind you is going to lift money from your NFC card.

Unless there's a practical method to electronically pick your pockets then why are you worrying about it?

[Anonymous Coward]

Meh...

Yes, still FUD.

I could choose not to take NFC cards out with me if I anticipated walking home alone or something.

I could choose to enable a passcode or similar function on an NFC phone.

Solving those issues took very few compute cycles.

[Nash]

its got to be....

Apple?

[Elex]

Google Places

IT could be for Google Places check-ins. The tags will be sent to business what want them?

They rolled this out to Portland and Austin, maybe they want another city now. It makes sense in the grand scheme, with their G+, androids and whatnot.

Even if it's not Google Places, I'm still guessing Google.

[Pierre Castille]

Put them at the bus stops!

Buy your ticket before you get on the bus. When the bus comes hop on and and away you go without the interminable wait to hand over cash, get change, get ticket, etc. If everyone did that bus journeys would be a lot faster - as they were in the older days when bus companies employed bus conductors.

Not got a suitable phone? Not handing over any personal details because 'your personal data is private'? Not got any money on the phone/rfid account - well walk!

Simples

[Anonymous Coward]

Bus stops?

It would be rather expensive, methinks, to equip every bus stop with electronic payment facilities. Additionally they might be vulnerable to theft or vandalism.

Seems to make much more sense to place them on the buses...

Alternatively you could buy through an app on your phone (which does not necessarily need NFC) before boarding. This way could be convenient to peruse offers for 'weekly saver' and so on.

[Some Beggar]

NFC payment cards are already on buses.

Oyster cards in London, for example.

[Anonymous Coward]

Indeed

However, it is likely that Oyster cards will find themselves quite pointless for many as NFC becomes widespread. You won't need to 'top up' or anything fiddly like that.

[Some Beggar]

Probably.

Unless the Oyster People have done some whacky proprietary stuff on top of the RFID.

Sadly, we live in a world of exponentially diverging standards, so there's a good chance that your Oyster card and your Barclay's paypass card and your Starbucks Instant Hot Milkshake Loyalty card will be sufficiently different that they'll never all be replaced by your smartphone.

[dogged]

Hold on...

Which bus company is now a "major handset manufacturer"?

[Some Beggar]

Nobody is suggesting that a bus company is a handset manufacturer.

Are they?

[Trygve]

Have any of you been to the US lately?

They seem to have moved on from 'take signature, don't check it', past 'take signature on resistive pad' to 'bah, nuts to signatures'.

I just spent a week in NYC and apart from checking out of the hotel and buying a meal in the airport, every single transaction was just a matter of swiping the magstripe and handing me the receipt. No signature, no ID, nothing. I have no idea how they make that work from a fraud perspective, but it's certainly interesting that they've taken things to such an extreme with cards that are an order of magnitude easier to skim/clone than NFC or RFID.

[gta]

no signature needed in US

I think the "no signature required" thing in the US depends on the transaction size, maybe below $20 or so. Not universal either, our local coffee shop still needs a signature for a $1.50 cookie.