Re: [w3ctag/design-reviews] Web NFC (#461)

> The user indeed does not know what information is on the NFC tag, but likely wants to know, which is the main reason the user engages into reading the tag.

The user may want to know something about what's on the tag, but they might not know how much information is on it or want to share all of it with the site.  Let's consider the example of airline boarding passes -- they have information that's currently on barcodes, but could plausibly be an NFC tag rather than a barcode.  Travelers are sometimes surprised by the amount of information in the barcode on the boarding pass.  I think it generally contains enough information for somebody in possession of the boarding pass to go to the airline website and modify the reservation (e.g., change or cancel the remaining flights).  Somebody scanning the barcode (or tag) in order to check their flight's status might not expect to be giving away that amount of information.  (This is a specific example of the "hard to explain to a user" problem in https://github.com/w3ctag/design-reviews/issues/461#issuecomment-648471296 .)

> No, reading a tag cannot identify the user.

What if it's an NFC tag on a conference badge or a boarding pass?  Or, as you mentioned, a tag with a known location, which could reduce the potential set of users to a small set (perhaps not of size 1), which is relatively close to identifying the user.

> No, reading a tag cannot reveal a particular disease of the user.

So I can come up with a straightforward examples of this for bluetooth scanning:  some modern glucose meters support bluetooth for transfer of data, so if a bluetooth scan identifies a glucose meter nearby, it would suggest that the user (or a member of their family) is likely to have diabetes.

Insofar as NFC becomes used within hospital settings, within medical practices, or on medical devices, it seems like this might become possible for NFC as well.

> No, reading a tag cannot share one of their second-factor authentication tokens.

There's a discussion of this exact attack starting at https://github.com/mozilla/standards-positions/issues/238#issuecomment-578457411 .  I believe that discussion led to the one known device where it happens being blocklisted from WebNFC, but that doesn't guarantee that it's the only device with that problem.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/461#issuecomment-651241059