Although we can't dissuade AmEx from sending us RFID enabled cards, we can control when RFID is active or not. By turning off RFID when we don't want it used, you avoid many of the security issues with RFID. Try using Smart Tools' RFID Shield to turn on and off RFID communications at your command. There's info at:
http://smarttools.home.att.net/rfshield.htm

**************************************************
Comment from Brian Chee
Yeah, this is an attempt at free advertising...I challenge you to find a switch to "turn off" the RFID on the physical card. The only way to turn off the RFID on the physical card is to: (1) hit the chip with a hammer...(2) find a metal lined wallet so that the RF energy can't power the chip and have it respond with its information.

Nope...this was definatley a thinly disguised ad...

/brian chee

Dude, you're protected against fraud if your identity is lost or stolen anyway! Even if someone managed to decrypt your RFID code (which I am not sure is possible, your DVD example notwithstanding) as soon as a false charge came through you would be protected as long as you called and told Amex.

*********************************************
Comment from Brian Chee
ah...but it's the "card present" clause that worries me. If someone scans the RFID and uses the "Express Pay" then it could be interpreted as the "card is present" which you've now got a different level of hassle to prove that it wasn't you when the card is still in your possession. You also have to know you've been scanned, you may not know until your statement arrives, perhaps as much as 30 days later. So while "your protected", the onus of proof changes due to that little clause.

/brian chee

*************************************************************
Followup from Brian Chee
Ok, I now have a written response from American Express that yes, they do consider remote harvesting of the RFID/Contactless Smart card information to be under the "card theft" clause and yes you are protected. I have strongly asked them to consider clarifying it in the card agreement and they're considering it.

Second, the number that is sent by the chip is different from the card number (as said before by another commenter) but what isn't spelled out is that Amex can disable their system from allowing that number to be used separately from the physical card. So they disabled all my "Express pay" chips numbers for all my cards and everyone is now happy.

So even if someone harvests the number...they can't be used...so nice compromise.

All in all, kudo's to American Express Customer Service for handling a pissed off journalist/techie well....but shame on the marketing folks for not being proactive about this in the first place. This should have been an "opt in" program.

/brian chee

You do know there is a difference between RFID and Contactless Smart cards right? You also understand that the contactless cards use a dynamic card id, meaning the 3 digit code on the back of the card changes each time it's used. so if somebody managed to skim they wouldn't be able to get the card to generate a useable CID, so no soup for you

**********************************************
Comment from Brian Chee
I do know the diff...and Amex keeps saying RFID...so I'm trying to find out which one they're really using. So my question to you is: Do you know how to tell them apart by looking through the clear plastic on the Amex Blue card? I can't and there isn't any number on chip.

That and there seems to be a pretty darn LONG antenna on embedded in the card.

Here's what Amex sez about their Express Pay System:
https://www124.americanexpress.com/cards/loyalty.do?page=expresspay

They do NOT expressly say which technology they're using. You actually have to dig onto third party sites to find out, and while you're NOT liable for charges made if the card is lost or stolen...they haven't updated their agreement to include "grazing" of the RFID/Contactless information.

So it would seem the only clue on the american express site as to which technology they're using is the little symbol of a wave in an oval with a hand holding a card. The assumption I'm making is that this is a contactless smart card rather than a traditional RFID? Geez, it would have been nice if someone had actually added some assurances into the FAQ on the site.

I saw a demo at CES a couple years back and it sounded good, but when I tried to get the guy to tell me more about "grazing" issues, he stumbled and said he'd get back to me...never did...

So, I'm still not convinced that my pounding the crap out of the chip was or wasn't a good move on my part. I'm still mad that Amex has done a really crappy rollout of what could be a good tech. I like to remind IT folks that while a particular tech might be superior to brand X...the back office folks make a pretty big difference over the long run. Just look at the conflict of VHS versus BETAMAX in the VCR wars.

/brian chee

The chip in the Amex is an ISO 14443 contactless chip. Interesting enough Amex actually responds on the contactless interface with a different account number than the one printed on the front of your card. Both account numbers link back to your statement. Visa so far that I have seen does not do this. It still remains to be seen what happens if I read your contactless interface account number and use it on a no 4 digit ID required web site. I think you could still purchase.

As far as the unique changing ID number that can't be replayed. It can be subverted by using a relay (not replay) attack. Google "practical relay attack on ISO 14443" for a white paper on the details.

That all being said my company Identity Stronghold specifically makes metal shielded Tyvek credit card sleeves to block the 13.56mhz signal. We have done this for the new US Passport and the new Federal employee ID card which both use the same ISO 14443 interface as the contactless credit card. It is interesting that the federal employee ID card (PIV card) requires issuing a shielding sleeve or our badge holder with the cards.

Also the new Passport Card and Washington State Enhanced drivers license ship with our sleeve.

You can see them at www.idstronghold.com

******************************************************
Comment from Brian Chee
My sincerest gratitude for a well thought out and informative comment. Since many enterprise grade physical security folks are examining new identify solutions, I'd love to have an offline conversation on this technology.

/brian chee