
Near Field Communications: a technology primer - evo_9
http://arstechnica.com/gadgets/guides/2011/02/near-field-communications-a-technology-primer.ars
======
simias
My main concern with NFC is the security, and I must say I'm not reassured by
the "Security" section of this article:

> NFC is considered to be inherently secure since two physical devices must be
> brought together in such a short range.

I don't see how that makes it "inherently secure". In the first page, it's
written that "the spec does allow for maximum distances of up to 20cm, though
4cm or less is common", I don't know how small NFC readers can be, but if I
keep my NFC-enabled card in my pocket someone in a crowded bus or subway could
certainly be close enough to gather the data.

Next, they go on to say that "encrypted communication is not a requirement of
the NFC specification". Wow. I do hope credit cards and such at least are/will
be using encryption.

I don't quite get their last concern however:

> Probably the largest possible threat for most users will be theft of an NFC
> device. If someone steals an NFC-enabled credit card, for instance, there's
> nothing to stop them from waving it at compatible pay terminals until the
> card is reported stolen.

This is not really a problem of the NFC technology per se, if my current visa
is stolen it can be abused on online websites the same way. Does it mean that
NFC forbids the use of a PIN to allow the transaction? If so, I think it's
braindead, it's easy to steal cell phones and if it means that you can go to
any ATM and empty my account if you can steal mine, I definitely don't want to
use that.

~~~
peterwwillis
It's 1-factor security, so it will only ever be as secure as 1-factor; if you
can steal it you have access. I can take someone's debit card to the bank
drive-up window and empty the account, so yeah, I wouldn't worry about if you
carry a debit card around.

~~~
metageek
Debit cards are 2-factor.

~~~
peterwwillis
i can use a debit card in stores and online without a pin, and take money out
of the bank without a pin at the drive-thru. if all i need is a card that's
one factor.

------
iwwr
Hook up a few loops of speaker wire into a necklace. Connect the wires to the
audio port of a cell phone, stick a tiny magnet in the ear canal. The small
audio current will cause the magnet to vibrate and transmit sound. This has
been used for cheating on exams for a number of years.

~~~
Luc
Well, theoretically. I've tried this with an amplifier and the signal is still
weak and unreliable. The magnet needs to lie against your eardrum to get a
good signal and the sound is very thin. I'd be impressed if someone has ever
used this method successfully during an exam (even solving the reception
problem, you'd still need to have a way to get the correct information played
back).

