Invisible Radios: NFC and RFID Myths vs. Real Risks

Podcast: Download

TEC361: Most of us tap something every day: a phone at the coffee shop, a badge at the office door, a hotel key, a transit card. Those taps all run on the same family of radio technology, and a lot of the worry about it is pointed at the wrong place.

Dom Bettinelli, Thomas Sanjurjo, and Jack Baruzzini start with the basics. RFID is the broad family: a reader sends out a radio field, and a chip with no battery of its own wakes up and answers. NFC is a narrow slice of that family at 13.56 MHz, designed to work only a couple of centimeters away. The question that decides security isn’t the frequency. It’s whether the chip simply announces a number or runs a challenge and response before it says anything.

So is tap to pay safe? The panel makes the case that it’s safer than swiping. Your real card number isn’t stored on your phone, and every tap carries a one-time code that is useless seconds later. Compare that with the magnetic stripe, which is why gas pump skimmers have worked for so long. Jack shares how his phone kept paying while he waited on a replacement card, and the group wonders how long card numbers will last at all.

The weak spots are elsewhere. The Unsaflok research showed that one card from a hotel using Saflok locks could be used to forge keys to every room, across millions of doors. Old 125 kHz office badges can be copied in seconds with cheap tools like the Flipper Zero, and Dom has practical advice for anyone running a parish, school, or office: ask your vendor what badge technology you use. Boston’s CharlieCard gets its own story, from the MIT students hauled into court in 2008 to the high schoolers who presented their “infinite money glitch” at DEF CON in 2023.

Then comes the myth-busting. Do RFID blocking wallets work, and do you need one? For payment cards, probably not. Passport chips are better designed than the early scare suggested, and a drive-by skim in a crowd is much harder than it sounds, as Thomas knows from building his own reader. The real danger, the panel agrees, is the same as it has always been: someone talking you into doing something unsafe.

For picks, Jack found comfortable, inexpensive stretchy Apple Watch bands, Thomas recommends the what3words app for sharing an exact location, and Dom explains why he chose eufy security cameras that keep footage at home instead of in the cloud.

Get all new episodes automatically and for free:
Follow by Email | Listen to this episode and subscribe on YouTube.

Help us continue to offer Secrets of Technology. Won’t you make a pledge at SQPN.com/give today?

Links for this episode:

Picks of the Week:

Want to Sponsor A Show?
Support StarQuest’s mission to explore the intersection of faith and pop culture by becoming a named sponsor of the show of your choice on the StarQuest network. Click to get started or find out more.

Disclaimer: Hosts, panelists, and guests may have a financial interest in the companies discussed through investments or other means. Their opinions and recommendations are not affected and do not present a conflict of interest. We offer this statement in the interest of full disclosure.

by
Secrets of Technology