Toys

Some of the best RFID design out there is in the toy box. Kids don't read manuals, so the interaction has to be obvious: put the thing on the other thing, something happens. Under the plastic it's ordinary 13.56 MHz RFID, used in two quite different ways.

#The toy is a key

#Yoto (and Tonies)

A Yoto player is a screen-free speaker for kids. Slot in a card and it plays a story, an album or a podcast. The card holds an NFC tag with an identifier. The player reads it, asks Yoto's service what that card is, and streams or downloads the audio.

That's identification in its purest form: the card is a number, and everything interesting lives in a database. It's why the same card can be updated with new episodes, and why Make Your Own cards work: a blank card is just a fresh number that you link to audio you upload.

Tonies do the same thing with little figures that you stand on a Toniebox instead of slotting in cards.

#DropMix

DropMix (Harmonix and Hasbro, 2017) was a music-mixing card game. Each card is a piece of a real song: a vocal, a bassline, a beat. The board has a row of slots, each with its own NFC reader, and it tells a phone or tablet app over Bluetooth which card landed where. The app does the actual mixing, so a hip-hop vocal over a country banjo line sounds surprisingly good.

Again, the card only carries an identity. All the music lives in the app.

#The toy is a memory card

#Skylanders

Skylanders (Activision, 2011–2016) started the toys-to-life craze. Put a figure on the glowing Portal of Power and the character appears in the game. The clever part is that the figure stores your progress: level, gold, upgrades and nickname are written back onto the chip in its base. Take your figure to a friend's house, plonk it on their portal, and your character turns up fully levelled.

Under the base is a MIFARE Classic chip, a HF memory card with sectors that need a key to read and write. That design dates from long before the toys, and its weaknesses are well documented (see Why old cards are a bad idea), but for a toy figure the stakes are a level-12 dragon, not a building.

#amiibo

Nintendo's amiibo figures and cards (2014 onwards) use an NTAG215, a standard NFC Type 2 tag with about 500 bytes of room. A Switch reads them through the right Joy-Con or a Pro Controller. Games use them in two ways:

• as a key: tap the figure, unlock a costume or get a daily bonus
• as a memory card: some games save data onto it, for example a fighter that learns from how you play. Each amiibo holds save data for one game at a time.

Other toys-to-life lines, like Disney Infinity and LEGO Dimensions, came and went in the same few years using the same basic idea.

#Why HF?

Toys landed on 13.56 MHz for the same reasons payment cards did. Short range means the toy only triggers when it's actually on the reader, not when it's lying near the console. Chips are cheap and made by the billion. And the antenna is a few flat turns of wire that fits in a figure's base or a playing card.

With Your phone

NXP TagInfo identifies the chip in a toy. Many iPhones won't talk to MIFARE Classic at all, so Skylanders figures may not show up there.

With Proxmark3

hf search names the chip family in a figure's base without needing to take it apart.

With Flipper Zero

NFC → Read identifies the tag type and UID in a toy.