Where's the beep?: security, privacy, and user misunderstandings of RFID

  • Authors:
  • Jennifer King;Andrew McDiarmid

  • Affiliations:
  • U.C. Berkeley School of Law;U.C. Berkeley School of Information

  • Venue:
  • UPSEC'08 Proceedings of the 1st Conference on Usability, Psychology, and Security
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

While extant for decades in the industrial sector, radio frequency identification (RFID) technology is increasingly being incorporated into everyday products and objects. This growing ubiquity brings with it security and privacy concerns for end users due to implementations that fail to adequately protect personal or identifiable data stored on RF transponders, as well as RFID's inherently stealthy broadcasting capabilities. Accordingly, taking effective measures to mitigate the risk of undesirable data transmission requires understanding what RFID is and how RF transmissions work. In our exploratory research, we attempt to elicit user mental models of RFID technology by interviewing users of three existing implementations of consumer-focused RFID technology: RF-enabled credit cards, transit passes, and the U.S. e-Passport. We explore user comprehension of RFID technology generally and these implementations specifically to gain an understanding of how end users conceptualize RFID and its risks. We found in this initial inquiry that our subjects generally lacked a mental model of how RFID functions, and in turn did not understand risks posed by RFID implementations or how to mitigate them.