🚀 go-pugleaf

>RFID is simply a number or ID on a card.  This ID number can be read by an 
>RFID reader.  The ID in itself means absolutely nothing.  That ID linked to 
>a database means everything.  

Unfortunately, you can say the same thing about the USA Social
Security Number.  That doesn't make revealing your SSN to the world
harmless.

>As long as the security of the database is 
>good and the ID is not a combination of identifiable information, then RFID 
>is not a security risk.

The database behind a Social Security Number is held by the US
government.  Let us assume for the moment that this info is perfectly
secure.

Why, then, is a Social Security Number associated with a name so
valuable to identity thieves?  Because there's another database,
or lots of them (particularly 3 big ones called "credit reporting
agencies"), and the SSN can be used to tie bits of information
together.  Anyone can start their own database tied to SSN as long
as you can persuade the people involved to give up the SSN.

Any unique identifier can be used for this, even if you don't use
it for its original purpose.  (e.g. Radio Shack tried to tie purchases
together using home phone numbers).  MAC addresses on wireless
devices can potentially be used to tie together different actions
on a network.  (Stolen) credit card numbers can be used to tie
together bogus accounts signed up at an ISP, even if the ISP has no
info about who really owns the card.

>Short answer is the ID is meaningless without the link to the data.  There 

Unfortunately, there isn't *THE* link.  Anyone can make a link to data
using anything they can get their hands on as a (supposedly) unique key.

					Gordon L. Burditt