RFID-Blocking Wallet

Many of the cards we carry in our daily lives have RFID chips, which are necessary for their functionality but also allow for data-mining. Is an RFID-blocking wallet the best way to protect yourself? Or are these just overrated novelties that don't do anything useful?

I ordered one for 2 dollars, plus shipping off of wish. It's identicle to one of those expensive "ridge" wallets they're selling for like $100 dollars. fuarrrking ridiculous really. It works too, I've tested it with both the nfc reader in my phone, and also at the gas station.

>>9395 >It works too, I've tested it with both the nfc reader in my phone, and also at the gas station. Fair, I'd be interested to see if it blocks 125 KHz as well. If you get a chance to test it, please post back!

Depends on your threat model like always: if you carry 'important' badges from your company (access badge to get in)or something similar yeah they can be useful. Other than that they are pretty useless. Sure they can scan your passport but why? All they can scan is your name and a few infos already written on it and the border security crypto key. They can't just make a copy. They have access to your address but why would they care? And for the few paranos that will tell me about big bad governments etc: Most of you carry a phone already lol. They are not gonna scan your wallet to have infos they already have.

>>9397 >Most of you carry a phone already lol. They are not gonna scan your wallet to have infos they already have. Dragnet is dragnet though. Collect now, sort later. I agree with you though, the chances of carrying a meaningful card in one's wallet are not really high. Who carries their badge in their wallet...

>>9398 Yeah, my point was that they are useless for most people. At least we can't say it's usefull without knowing everything about what OP is carring and who are is potential enemies

>>9396 I'd be glad to. Could you tell me how to test that?

>>9396 Without buying extra hardware? I'm not sure. If you have SDR capable of scanning 125KHz and 134KHz, maybe give that a go? Worst case scenario, LF read/writers can go from $15+ on Amazon. Or you could go nuts and get a legit HID reader /shrug

https://www.flipsidewallet.com/ I've got the 3X version of this, generally have liked it pretty well. Wish it would fit a business card inside of it, but I've been using the rubber strap to hold them instead. It also gets a little dusty on the inside since it isn't really sealed. If they made a sealed/waterproof version that would be sweet.

>>9398 >I agree with you though, the chances of carrying a meaningful card in one's wallet are not really high. More and more payment cards are NFC enabled. Do you not consider this a "meaningful card"? >Who carries their badge in their wallet... If I had a dollar for every time I saw a coworker swipe their wallet to get into the building, I'd be sitting pretty.

>>9403 >More and more payment cards are NFC enabled. Do you not consider this a "meaningful card"? Except almost every bank in the world is giving you the choice to disable NFC nowdays. It's not even just disabled on the card itself, the bank is blocking it so nobody can use it.

>>9403 I agree with your other point, I honestly forgot about NFC for payment cards... What a horrible idea that was. But swiping your badge from your wallet makes zero sense. Why? You have to wear your badge out when in the facility. All the places I've been I've never seen that but maybe once on one of those hip-phone-wallets. Not saying you're lying but wherever you see that is a soykafhole unique to it's own.

>>9418 My bus pass is NFC, lots of people just swipe their wallet. Debit and Credit cards have a limit of usually 50 or 100 dollars per day, so it's pretty convenient. Plus you're protected if someone steals your NFC info.

>>9419 Fair. I'm just saying for entry into the workplace, if you have a badge system at work, you're 99.999% likely to have a badge exposure policy so keeping it in your wallet makes no sense.

>>9394 I know a few people who said to just cover all of your cards with metal sandwich foil, though I have never seen any literature on this, it sounds like a sound method of making a Faraday container/barrier

>>9421 Police who take cellphones into evidence sometimes immediately wrap them in multiple layers of common aluminum foil, to prevent wireless tampering. Copper foil is better. Copper bags and containers are sold for cases where phones may have been compromised by malware that causes phones to fake being turned off. Another reason why removable batteries are nice. But I'm sure Agent Fud will soon show up to remind us that only lunatics and criminals like privacy and security. :)

>>9404 Not seeing that option, perhaps mine just is like kicking dead whales down the beach. >>9418 >You have to wear your badge out when in the facility. >>9420 The number of places that required my badge be visible is less than the number of places didn't, like on the level of 1:3.

>>9423 That's poor practice and definitely the opposite from what I've seen.

What effect are you trying to pursue with this shielding? Most cards require double-factor authentication when you use them: a permanent PIN number or a 3d-secure one-time PIN. Even if an attacker scans all the data (it's not laying open there, the important part is decrypted by the microprocessor inside the card), he won't be able to do anything with just card number and expiration date unless it's somehow possible to copy the hardware that's inside by scanning it with RFID reader which is not.

I've tested some wallets with a proxmark v3, basically works unless you're on top of the rfid chip and there is minimal insulation. There are some RFID readers you can buy for a few hundred dollars that can read cards past 6 feet away, but I never got to test it myself. If you wanna feel safer, try finding a Faraday bag that will fit your wallet and still fit in a pocket.

>>9422 >Police who take cellphones into evidence sometimes immediately wrap them in multiple layers of common aluminum foil, to prevent wireless tampering. Off topic but I think a software switch that would trigger immediate data wipe upon simultaneous loss of all wireless signals would be handy in a situation like that.

>>9550 Faraday cage needs ground from my understanding, the mesh should be smaller than wavelength of electromagnetic field we're trying to shield from. Is there a layman's guide to Faraday cages and electromagnetic shielding? Might worth a read for grasping the basics. >>9558 Well, no subway for you then. It's as silly non-solution similar to screen locking with password instead of suspend to disk with encrypted swap. You have to keep all sensitive info encrypted by default, with small time-out windows. So even if they get a hold of the device with un-encrypted filesystem, sensitive documents will be still encrypted and police won't be able to access them after say, 3 or more minutes. Having some sort of second factor authentication "token", that is, when separated from phone or computer, prompts immediate lockdown is better in my opinion: + A USB device strapped to hand is simple, but obvious and crude: could have saved Dread Pirate Roberts in his case. There is also a reverse but similar approach that shuts down PC upon connection of unknown or any USB device in it's ports, police used a mouse emulator that jitters the cursor keeping the PC from logging off, or going into suspend, which in case of Ross Ulbricht arrest in library, allowed them to later read all his notes and documents which were stored in plaintext on his local filesystem. It's called USBKill (don't confuse with USB Killer which is an electric zapper for destroying USB ports) + A NFC bracelet or ring that, upon separation with device, prompts full data encryption or shutdown is also a better option, and is better concealed. It might be also possible to store encryption keyfiles on the NFC device and transwerring them safely over wireless channel, so upon destroying NFC ring's memory, the data won't be retrievable from the phone even if someone rubber-hoses a password from your mind.

>>9422 A built-in battery and a modified firmware can allow you to have a built-in dead man switch that can force a mode if you miss a report deadline or some condition is not met, e.g. your BlueTooth dongle has been disconnected (separated from your phone) for too long. The built-in battery makes it hard for others to tamper with. There is no "objectively better" option, both have advantages over the other.

>>9559 An efficient Faraday cage needs to be grounded, and it will then absorb pretty much all waves, assuming the mesh is fine and conductive enough. When ungrounded, the mesh acts as some weird, surrounding antenna/resonator, but it is very hard to model how it will interact. It can passively modulate signals, affect phase coherence and resonate at certain frequencies. If your protocol is digital and very sensitive to interference, then it's pretty much toast. Analog signals can still get through (distorted) so an ungrounded Faraday cage will prevent most tech from working (as almost all tech is not design to bypass ungrounded Faraday cages), but may not necessarily prevent e.g. a radio operator from working out the effects and transmitting or receiving intelligible or decodable messages.

>>9559 USBGuard is a policy framework for Linux that allows you to perform arbitrary actions based on conditions. It can prevent USB devices from functioning based on VID:PID, port number, USB attributes like serial number or device type… Re: USB killer, you could modify your machine so that unused USB ports become honeypots that fry anything that's connected to it or simply fry the whole computer.

>>9394 >something >protect yourself >is it best way? It all depends on your threat model. What are you protecting yourself from? People from gaining unauthorized access to your work site? Well, it depends on the technology behind your access card. Most technology worth anything nowadays will not simply allow itself to be copied. Modern RFID cards have a challenge-based approach to security, and the private key is simply etched in ROM, so there is no way a reader can extract the key. The chips are copyrighted and patented as fuarrrk, so you would need to reach out to extremely shady people if you need tech that can work with that. The kind of shady that you should not give your payment info out to anyhow. Furthermore, the door locks have countermeasures against relay attacks by setting incredibly small timeouts for challenges, meaning that if the signal is repeated to your card, the reader will detect the additional latency and reject the response. A car manufacturer used to be vulnerable to an attack of that type because they did not implement distance logic, instead relying on signal strength to stop amplification or relay attacks. They implemented timeout logic in a software update after the vulnerability was exposed An attacker would need knowledge of encryption material to enable a cloned card to work, and any card manufacturer would have a secure means of installing the private keys in the cards. Are you preventing someone from processing illegitimate transactions on your credit card? An attacker needs a payment terminal do so, and they are linked to merchant account (they can't just print money). The credit card companies usually catch rogue terminals pretty quickly based on many factors like having spurious amounts of transactions all of a sudden, unusual transaction amounts for the type of business you are running (it is suspicious for a convenience store to routinely have transactions of more than $100 for instance) and in any case, you are always protected when it happens to you, so while it's an inconvenience, it is rarely a real problem. If you don't care about tap to pay, drill a hole in a corner of your card to cut the antenna loop and demagnetize the strip. Your card is now chip&pin only.

>>9565 Can attacker passively read identifying information from payment cards without prompting cryptographic challenge, the number and cardholder name?

>>9581 Mastercard says that they can't. I usually see my full name and the last four digits of my credit card on the receipt when I use its chip, but none of that will be present if I opt to use contactless instead, so they might be right after all. https://newsroom.mastercard.com/2018/01/17/dispelling-the-myths-the-reality-about-contactless-security-2/ >First, contactless payments require different information than those made over the phone or online. The cardholder’s name, three digit security code on the back of the card, and billing information like zip code are never transmitted. Instead, along with the account information, a one-time-only code is sent from the card or device to the reader to identify that transaction. I'm not sure about that "account information" though.

>>9584 Cards like mifare transit passes, e-ID documents and passports can be read passively, and even in case of cryptographic challenge requirement, a rogue adversary with access to online terminal can identify people without their knowledge by scanning their rfid documents. A paper document or smart card with physical contacts would never allow this sort of attack. Yeah, I really wish we, human beings were not treated like cattle and could opt-in for free hardware methods with proven strong cryptography for our authentication instead of bullshit obsolete proprietary security through obscurity systems.

>>9394 they're pointless. just dont carry cards around like a retard zoomer. they're literally pointless aside from a few edge cases like needing to go to the bank. all the data mining is happening when you scan them at the store.

>>9588 >data mining is happening when you scan them at the store 100% this. Of course, some weirdo with hacked up hardware could scan your card somewhere and extract some shards of information but this scenario is rare. You have to watch against merchants using cards to track your information. Every time you pay a store with the same card, they have all your purchase history. From that, they can extrapolate so many things. Even worse if they are a part of a conglomerate that shares all the information. He bought plumbing supplies? Probably a male. He went to two different stores? He has a car! He came every day when big macs were on sale but rarely comes otherwise? Oh, we better do one of those sales again.

>9588 >all the data mining is happening when you scan them at the store. This isn't true. Commercial Surveillance systems also want to capture where time in store is spent, what percentage of customers buy ("conversion"). Some of that tracking is enabled by bluetooth, NFC beacons, or wireless devices, mostly smart phones. Its probably unlikely that your cards are being scanned to provide identity, but without hearing about it, would you believe that your phones probe requests and MAC are being monitored to give you persistent identity by Best Buy ? Why emit any wireless signal at all ? I have a RFID blocking wallet. A few problems with them though: *A lot of random soykaf is labeled "RFID Blocking" that basically isn't. If its not a hunk of ugly metal, it probably doesn't work. *They are ugly as fuarrrk. not shway. RFID blocking sleeves exist. Also top schway are Faraday Cages (like silent pocket). I don't own one yet.

A more complicated but less punishing way of doing what's expressed in >>9565 is put a switch on antenna wire so the circuit would be physically disconnected until the contact is shorted.

I'm looking for some quality RF shielding fabric, to make pouches for my devices (faraday cage) and possibly work on a mask that could mitigate something like this: https://news.ycombinator.com/item?id=22056194 (just as a hobby CIA I swear). I live in Europe and I would rather not pay import fees. Is anyone knowledgeable in this? / Know any good vendors? Thanks.

Heavy copper foil would be suitable. Note that it needs to be formed into a "light-tight" shape or there will be leakage. You can test it by putting your cellphone in it and trying to call it. Note that NSA headquarters in MD is pretty much a copper-shielded box.

>>9948 Thanks bro

I'm also Interested, I'll do some research and get back to this thread with what I find.

Can't work fam faraday cages have to be a closed system that s either a sphere (closed covered) or a grounded item.

>>9948 Couldn't you achieve the same with aluminum foil?

>>9955 You pretty obviously don't understand how they work

>>9937 >faraday pouches I've seen people talk about this a lot, but unless it's combined with some sort of soundproofing hardware there's nothing to stop the devices uploading whatever they have recorded once it they are within range of LTE/wifi. Has anyone managed to solve this problem while making the case small enough to fit in a car glove compartment or backpack?

>>9961 recorded while in the faraday pouch, that is

>>9958 Aluminum foil will work, too, but copper is better. In fact, some cops are trained to immediately wrap confiscated cellphones in aluminum foil to prevent them being remotely accessed and wiped.

>>9961 There's no way around this possibility if the system is proprietary. Still mitigates location tracking when in the pouch.

>>9965 Well-funded police already have faraday pouches. It looks like civilians can get them easily too. >>9966 >physically disable microphone (ie fuarrrk it up) >plug in an external mic whenever you need one Most practical way I can think of. I don't think there's such a thing as pocket-size soundproof containers.

>>9961 There are still a few phones where you can take the battery out. You can also remove or destroy the microphones and cameras if you're serious enough about privacy.

>>9968 Take a punch/ smol screwdriver and lightly tap the center sensor glass on the camera, it should destroy the sensor which would disable it permanently, else just put tape/stickers over it

>>9937 This technology is not see-through-everything, it's just thermal imaging. Any sort of mask would obscure your face, and I don't see how a standard rf shielding is any better than thermal insulator against thermal imaging. To the rest of larps in this thread: don't bring a spyware device in your pocket if you don't want it to record your conversation, simple as. There is already a thread on this board about rf shielding >>9394, I don't see why we need another one, with idiots spewing the same inane opinions over and over again, and OP failing to understand the basics of subject he's referring to.

>>9998 I think you wete the only person who read the OP as wanting to use rf shielding to make the thermal mask. Maybe retards shouldn't act so self-confident?

>>9647 Data mining in the store is probably one of the largest markets, stores gather analytics on data about what isles are frequented, and compared to data for when people use cards or "loyalty" programs. They say it is to give you "the best discounts" but in reality it is to streamline adverts and optimize business models. Ideally, do not carry a phone when you go shopping. I have seen people with RFID fashion wallets, which are basically a piece of metal that sandwiches cards like a money clip. Which based on how RFID works, i have serios_doubt.jpeg when it comes to actually blocking signal or remote readers. I would agree that RFID sleeves are the best option for poorfagging your wallet protection.

>>10003 >I'm looking for some quality RF shielding fabric, to make pouches for my devices (faraday cage) Is being discussed in thread >>9394 >and possibly work on a mask that could mitigate something like this: (link to a discussion of thermal imaging technology) Any face mask that is not made of windshield glass, backlighting or light weather (e.g., fog) would prevent thermal image facial recognition. You see, the sample image shows portrait of a man reconstructed from infrared image, it does not show the man's skull under skin, neither it removes man's shirt, therefore we can make a conclusion that this technology would not work against fabric masks obscuring target's face.

>>10012 That seems a bit too assumptious. Who knows how exactly this works at this point.

>>9565 Drilling out antenna and gently concealing the hole with film is really the most efficient way to disable the RFID function. https://www.instructables.com/id/How-to-Disable-Contactless-Payment-on-Your-Debit-C/ One comment indicates that some cards have an antenna embedded right into chip pads. Cutting the surface of the chip disables this antenna. Also consider an advice from author of GnuPG: https://lists.gnupg.org/pipermail/gnupg-users/2018-December/061375.html >You should keep in mind that you can eavesdrop on NFC communication within several meters. Right, it is required that the card is not more than about 10cm away from the reader but that is only to convey the power to the card, the HF is readable from several meters as soon as the card is powered up. >If you care about side channel attacks, NFC communication is a bad idea because the decrypted session key can easily be picked up. To avoid this, *secure communication* needs to be used but that is cumbersome because this requires a shared secret between host and card.

>>9394 Just use cash. It's a lot more anonymous and universally acceptable.