Open or Closed, NFC Prospects Abound

="" Privacy for a bunch of nobodies???"

can you spell CLASS ACTION ?

a suit must be brought under the authority of a Public Law -- I'm very interested in that topic

Why the US needs a data privacy law—and why it might finally get one By Justin Brookman |REFERENCE: Published by ARS/Technica, July 18, 2011 8:37 AM

I would like to see the fundamentals of HIPAA extended to Personal Informatiuon  ("PII") generally

Chris,

I welcome your thoughts and inputs on this critical issue.

However from all my experience in Business so far,most Businesses look to cut corners and go for the fastest and cheapest implementation of any technology available,

This is what will go through a Senior Execs head,

" Privacy for a bunch of nobodies???

Who cares!!!

Lets go for the cheaper and faster solution-Open NFC,every single time.

"

Regards

Ashish.

@aum007

While you bring up the aspect about privacy, and it is a very good point to discuss as you have seen through out this article and comments,  there are a couple of things to remember.

First off, from a development standpoint the use of Open NFC should not be used for anything that you would not normally look online for through a web browser.  The use of the application should/counld be store specific allowing users the ability to search inventory that is already in that store's database.  This would be no different than if they were to use QR Codes to perform the same funtions for store visitors.

Secondly, the applications being used in an Open NFC environment should not have access to private information.  So should the application require such information the users should be made specifically aware.

Secure NFC which is the use of an encrypted version of the NFC technology is the only type of application that should have any access (limited at that) to any sort of personal information.  This information should be encrypted at the device level as well as all communications that the application would require.  @Mike Acker has done an outstanding job in helping reference this topic throughout.

As far as store check-in type applications, the users are already aware of GPS tracking that identifies them as being located at a specific location already.  This type of use would simply allow for more accurate tracking through applications like FourSquare that must attempt to pinpoint store visitors as it stands.

So as privacy should always be a goal sought by everyone as much as they can, it is to the extent that users allow their information to be accessed that needs to be focused on.  This typically should be done through training and education.

Mike,

I read(& am aware) of how easy (& cheap)it is to obtain the kind of personal data you want .

When you keep your PCs on 24/7 and always online you have to be prepared to deal with such situations.Today Botnets are actively scouting PCs which are online for any(& every vulnerability ) they can find as a way to build and strengthen their botnet.You have to be prepared to take it down one Master Server at a time.

But problem is you did'nt suggest a solution to the problem here.

Or did I miss it?

Regards

Ashish.

Chris,

Your  last question raised here

"How will you consider using NFC in the future? Will you incorporate item-specific sales with quantity and location information? Will you use it to promote targeted sales to tech-savvy mobile users? Or will you mass-deploy NFC tags throughout store locations to determine visitor check-ins?"

absolutely frightened me as I thought about the level and extent of privacy invasions that will take place with mass deployment of NFC.

Not exactly my cup of tea(if you ask me).

Do you (as someone who believes very strongly in privacy) want to deal with such an issue?

I know I don't.So Mass deployment of NFCs is obviously out of the question.Inspite of the fact that this is actually an advertisers/sellers dream.

Such detailed information on prospective clientele(as well as such reach).

Pretty sure I know who will be going Ga-Ga the most.

Regards

Ashish.

i think the main reason is: we have simply "ported" paper base procedures into an electronic network environment

what used to be good enough is now unacceptable:

• Visa/MasterCard -- they used to run the paper receipts thru the bank just like paper checks. Hackers had to settle for dumpster-diving the discarded carbons
• computers -- we used to have WordPerfect and Lotus. Hackers had to settle for boot sector pranks on floppy disks but stolen data wasn't going much of anyplace except down the hall on sneakernet

Contrast that with today's "Wired" environment

You can buy "dumps" (stolen credit cards) so much per M.*  You can rent a bot net, or have them set you up: $7/M. Sophos reports receiving 60/000 new malware items/day.

Both the P/C and the Internet were developed for purposes other than that for which they are now used. As a result there are serious deficiencies  and these just happen to be in security

Keeping up with the Hackers Chart on C/Net

everyone was in such a rush to get online they forgot their boots.  and guess what: it's nasty out there.

~~

* Suggested Reading:_KINGPIN_ Kevin Poulsen and _GEEKONOMICS: The Cost of Insecure Software_ David Rice

These "dumps" are stolen from merchant computer systems after or during transaction processing.  Which is why the Hackers are "ROF,LTAO" when people talk about "two factor id" as the "solution".  It will be of NO EFFECT: It's solves the WRONG PROBLEM

Mike,

When it comes to an issue as critical as this(failure to authenticate);do you think its because of a culture of complacency that has seeped into the System(oh I could never be attacked/hacked);or because Security never has enough Cash ;or because of something else which I missed[Like a  Culture clash between

Security and Rest of IT or a Culture clash between IT and Business]???

Thanks for your input!!!

Regards

Ashish.

what is scary is that failure to authenticate is such a systemic problem

worse, we have fools out there who think they can sweep their problems under the rug and make them go away by suppressing communication

the internet changed that

or more accurately, the internet finished that change: the change began with the 300 baud dial up modem and the BBS / FidoNet stuff

Suggested reading: Black Hat / Defcon

You always have some fool who thinks "I'll just suppress this information and then fix it later if i get around to it and have $$ for it in my budget

Suppress info? good luck, buddy

@Mike

Now that is just plain scary.  You park your car and then come back to where it was and all of a sudden it is gone.  Not very good planning on the car manufacturers part for sure.

War Texting (Network World Today)

Software that lets drivers unlock car doors and even start their vehicles using a mobile phone could let car thieves do the very same things, according to computer security researchers at iSec Partners.

Don Bailey and fellow iSec researcher Mathew Solnik say they've figured out the protocols that some of these software makers use to remote control the cars, and they've produced a video showing how they can unlock a car and turn the engine on via a laptop. According to Bailey, it took them about two hours to figure out how to intercept wireless messages between the car and the network and then recreate them from his laptop.

Again: the only reason this kind of crap is possible is because the designers failed to include digitial signatures for authentication of the vehicle commands, or (b) the software was vulnerable to unauthorized modification (i.e. their software was hackable)

“hackable” – again is a failure to authenticate, – not the commands – but the over the air software update