Link to home
Start Free TrialLog in
Avatar of curiouswebster
curiouswebsterFlag for United States of America

asked on

Wondering if my RFID blocking wallet works

I just bought a new GUSTT brand wallet (on Amazon) which blocks RFID. I have a few new credit cards which have the chip in them and had high hopes.

So I was excited to test it out since I have an MBTA Charlie Card and fully expected the wireless access to fail as I waved the wallet in front of the receiver. But the gate opened, like it used to with my leather wallet. So is this a valid test? Should the Charlie Card's signal have been blocked. Here's the technology used in the Charlie Card.

http://makezine.com/2012/07/17/how-to-embed-an-rfid-card-in-an-iphone/

Does this mean it's a "wallet failure"?

I am rather bummed (pun intended).

Thanks.
Avatar of gheist
gheist
Flag of Belgium image

It means that NFC was not blocked.
Just wrapping it in kitchen aluminium foil would help (you have like dozens of mifare readers on android to test with)
Avatar of curiouswebster

ASKER

What is NFC?

Doe this wallet do anything?

I do not have android and no idea what you mean...

I have iPhone.

Do you mean an app can read the WiFi admitted by my CC's so I can use this to test i the wallet works?

Thanks.
Particular frequency band used by mifare and credit cards and NFC was not blocked:
https://en.wikipedia.org/wiki/Near_field_communication#Design
Just return acessory to place of purchase
It has nothing to do with wifi.
Sorry about iphone, NFC radio that iphone has is not accessible to apps, so it cannot be used for your tests.
So, the wallet which Amazon sells:

http://www.amazon.com/GUSTT-Blocking-Genuine-Leather-Trifold/dp/B00TVACGKC/ref=sr_1_3?ie=UTF8&qid=1446316697&sr=8-3&keywords=gustt

GUSTT® Fashion Men's Royal RFID Blocking Secure Genuine Leather Wallets

does not do anything to block digital pick-pockets?

That's crazy!

What does it do?
Avatar of btan
btan

Charlie is MIFARE contactless card and strictly speaking has nothing on NFC comms. Indeed the card is weak in securing against pickpocket as proven by researchers. Check the security section under wiki of mifare.

It seems GUSTA is not shielding against MIFARE comms. Suggest you look at this instead
http://www.idstronghold.com/protect-your-information.asp
So, I do not care about protecting Charlie Card from digital snooping. I just thought it was a good test case. If it is a different technology from my credit cards, how do I test if it protects my credit cards?
simply using the wallet with those bunch of card inside and go through the reader and if that is read then the shield is not working as claimed. In fact those bunch of MIFARE card are low hanging and there is tool to scan them easily as long as they are within a distance to the reader
https://www.collistesttools.com/catalog/by-solution/transit-test-tools/collis-mifare-spy/c-24/c-1106/p-484

there is also some android apps to scan mifare classic card - note This App can NOT crack/hack
any Mifare Classic keys. If you want to read/write an RFID-Tag, you need keys for this specific tag first. There will be no "brute-force" attack capability in this application. It is way too slow due
to the protocol. https://play.google.com/store/apps/details?id=de.syss.MifareClassicTool&hl=en

thought it is good to differentiate btw NFC and RFID in case you like to find out more - NFC is subset of RFID family http://blog.atlasrfidstore.com/rfid-vs-nfc
I am getting very confused with these acronyms...sorry.

Please explain without the jargon.

I have a Charlie Card and have credit cards.

I DO NOT NEED to protect my Charlie Card. I DO NEED to protect my credit cards.

Are they protected with this wallet? Was my test with the Charlie Card a GOOD test, meaning it uses similar technologies as credit cards, and proved my GUSTT wallet fails?

Or was it a BAD test, meaning the underlying technologies as are different and the credit cards may still be protected even though the Charlie Card can still communicate wirelessly in spite of being in a shielded wallet?
Yes it does seems it stated to comply with RFID Block technology Approved USA Government FIPS-201 Security Standards. Credit card is not contactless (unless they have that wave symbol printed) so the wallet is just to protect wear and tear for such strip or EMV credit card. Even if these cards are contactless, they are still protected for the "pickpocketing"
So, you say the GUSTT wallet DOES protect from credit card theft? It's difficult to extract a simple narrative from someone as technically skilled as you are.

My fear is someone can walk by and wirelessly communicate with the chip on my credit card and read key information needed to defraud me. I assume this is what you mean by pickpocketing?

So, am I protected against this threat?

1) yes
2) no

If yes, is there a way I can prove it to myself?

Thanks.
Yes, if you have those PayPass or have a little "wave" symbol printed on the card, put in the wallet and go to any contactless e-payment like starbuck or coffeebean and try scanning with and w/o using the wallet (closed). Check the difference...also try with card inside in wallet but open the sleeves revealing the card and wave against the terminal, and check too...i suspect it is wallet must be fully closed up to really protect those contactless credit card or eqv.
is this the little wave from a credit card

User generated image?
See my last post on contactless and click that link to check on the wiki posting a sample image...the chip itself is not good indicator as it is for contact.
See the "little wave" you mentioned and No, neither of my credit cards with the chip have that wave. They both are to insert the card into the bottom of the machine rather than swipe the card, the old fashioned way. I have found you insert the card and leave it there throughout the transaction.

Plus, I just recalled, I do indeed have an Android tablet I rarely use. So, I could install that app and attempt to read my card? Or is that that app strictly for reading cards which are expressly contactless?

Thanks.
So, here's what I am gathering here...

My Charlie Card worked from inside the GUSTT brand wallet so IF I had contactless credit cards, they would be just as exposed using that wallet. I do not yet have those kinds of credit cards, so at the moment, I have no risk of being pick pocketed (aside from the $12.50 on my Charlie Card).

Is this a correct conclusion?
SOLUTION
Avatar of gheist
gheist
Flag of Belgium image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
thanks