What is the ID?
Most RFID is a radio-powered barcode. The interesting part is what happens after.
Strip RFID down and the basic transaction is:
- A reader makes a field.
- A tag wakes up and says a number.
- Some computer looks that number up and decides what to do.
The tag usually doesn't "know" anything. A badge doesn't contain your name or which doors you can open — it holds a number, and a database somewhere maps that number to you. A retail tag doesn't know its price. A pet microchip doesn't know the owner's address.
#Identification is not authentication
Saying a number is identification: "I am #4021." Anyone who hears it can say it too.
Authentication is proving it: the reader sends a random challenge, and only a card holding the right secret key can compute the right answer. The answer is different every time, so recording it is useless.
A lot of RFID still in the wild only does the first one — that's most of why old cards are a bad idea.
Most tags also carry a factory serial number, the UID, which is where a lot of systems start — and sometimes, unfortunately, stop.