4
\$\begingroup\$

This is basically a replication of this question on Personal Finance SE. Suppose there's a wireless smart card like Visa payWave or MasterCard PayPass or MIFARE Ultralight. The owner wants to temporarily shield it so that it's totally impossible for a malicious third party to make the card confirm a transaction.

Will wrapping it into tinfoil be enough? How much shielding is needed to shield such card?

\$\endgroup\$
  • \$\begingroup\$ Interesting point. From personal experience, I can say that wrapping cell phones in aluminium foil can prevent them from communicating. I'd expect that cards which need to get the energy over radio in the first place would be even more susceptible to such manipulations. \$\endgroup\$ – AndrejaKo Apr 4 '12 at 7:19
4
\$\begingroup\$

Best of all a pocket of mu-metal.

BUT as others have said a sheet of metal foil close-by should suffice.

A sleeve of Aluminum foil glued on the outside of a properly sized plastic pouch would allows easy insertion/removal and long life.

MIFARE and other systems are almost always "near field" inductive power transfer systems. Your aim is to provide a conductive surface that the induced magnetic wave will dissipate energy in. Because the card is resonant it may be able to do some fairly wonderous things at low signal levels in some cases so a solidly enclosing metal foil pouch is probably wise.

Wikipedia MIFARE & variants

  • MIFARE is the NXP Semiconductors-owned trademark of a series of chips widely used in contactless smart cards and proximity cards.

    The MIFARE name covers proprietary technologies based upon various level of the ISO/IEC 14443 Type A 13.56 MHz contactless smart card standard.

Variants:

  • MIFARE Classic employ a proprietary protocol compliant to parts (but not all) of ISO/IEC 14443-3 Type A , with an NXP proprietary security protocol for authentication and ciphering.

    MIFARE Ultralight low-cost ICs that employ the same protocol as MIFARE Classic, but without the security part and slightly different commands

    MIFARE Ultralight C the first low-cost ICs for limited-use applications that offer the benefits of an open Triple DES cryptography

    MIFARE DESFire are smart cards that comply to ISO/IEC 14443-4 Type A with a mask-ROM operating system from NXP.

    MIFARE DESFire EV1 includes AES encryption.

    MIFARE Plus drop-in replacement for MIFARE Classic with certified security level (AES 128 based)

    MIFARE SAM AV2 secure access module that provides the secure storage of cryptographic keys and cryptographic functions


Hacking Barclays version with a cellphone - video news item. Python script to read the cards.

Nice pickpocketing demo :-).


VISA payWave

They say

  • Transaction Protection: Cards can only be read up to 4 inches from the secure reader and each transaction is accompanied by a unique security code to protect against fraudulent use. Plus, you maintain control of the card at all times, which reduces the risk of fraud.

More here with few seconds of video demo

\$\endgroup\$
  • \$\begingroup\$ I'm no expert but actual tests of "RFID blocking" wallets suggest they only block weak/cheap scanners. A good quality scanner such as a criminal would use is designed to work from larger distances and will penetrate most attempts to block the signal. Source: consumerreports.org/cro/magazine-archive/2011/june/money/… (also visa's claim of 4 inches is wrong, there have been incidents of badly made hardware that was found to charge cards at long distances, causing refunds/recalls/etc in the UK) \$\endgroup\$ – Abhi Beckert Jul 24 '13 at 16:44
5
\$\begingroup\$

A piece of metal foil (any metal) adjacent (within a few mm) to the card will do it. It does NOT need to be wrapped round the card - close to the card on one side, and at least about a quarter of the area of the card will do fine as this will damp any read field. As the card is powered from the read field, you do not need to absorb anything like the same amount that you would for a conventional radio signal.

\$\endgroup\$
3
\$\begingroup\$

A more durable option than wrapping foil around the card is to get a wallet with a wire weave in its construction to block RFID scanning.

I bought and tested a wallet like that with the proximity badge my employer uses for access control, and it prevented the badge from being read when I held large sides that would normally face out when the wallet is in a pocket against the reader and when I did the same with the top/open edge of the wallet.

\$\endgroup\$
0
\$\begingroup\$

I would imagine that if tinfoil works, then using the material in one of the film bags used by travelers to protect film from airport xrays would work well too

\$\endgroup\$
  • 1
    \$\begingroup\$ Actually, I doubt it. The wavelengths and the blocking mechanisms associated with them are completely different. \$\endgroup\$ – Dave Tweed Sep 21 '13 at 0:29
0
\$\begingroup\$

If they are all metal, then they should work as a Faraday shield. These have been used for years in all shapes and sizes, to shield against radio frequencies upsetting scientific tests etc. I am always wary of "snake oil" salesmen, trying to flog off dubious items.

\$\endgroup\$

Not the answer you're looking for? Browse other questions tagged or ask your own question.