I can now read all the passport information, including biometrics.

Background

The NFC chip in a passport is protected by a password. The password is printed on the inside of the physical passport. As well as needing to be physically close to the passport for NFC to work⁰, you also need to be able to see the password. The password is printed in the "Machine Readable Zone" (MRZ) - which is why some border guards will swipe your passport through a reader before scanning the chip; they need the password and don't want to type it in.

I had a small problem though. I'm using my old passport¹ which has been cancelled. Cancelling isn't just about revoking the document. It is also physically altered:

Cut off the bottom left hand corner of the personal details page, making sure you cut the MRZ on the corner opposite the photo.

So a chunk of the MRZ is missing! Oh no! Whatever can we do!?

Recreating the MRZ

The password is made up of three pieces of data:

1. Passport Number (Letters and Numbers)
2. Date of Birth (YYMMDD)
3. Expiry Date (YYMMDD)

Each piece also has a checksum. This calculation is defined in Appendix A to Part 3 of Document 9303.

Oh, and there's a checksum for the entire string. It's this final checksum which is cut off when the passport cover is snipped.

The final password is: Number Number-checksum DOB DOB-checksum Expiry Expiry-checkum checksum-of-previous-digits

Python code to generate an MRZ

If you know the passport number, date of birth, and expiry date, you can generate your own Machine Readable Zone - this acts as the password for the NFC chip.

def calculateChecksum( value ):
    weighting = [7,3,1]
    characterWeight = {
        '0': 0, '1': 1, '2': 2, '3': 3, '4': 4, '5': 5, '6': 6, '7': 7,  
        '8': 8, '9': 9, '<': 0, 'A':10, 'B':11, 'C':12, 'D':13, 'E':14, 
        'F':15, 'G':16, 'H':17, 'I':18, 'J':19, 'K':20, 'L':21, 'M':22, 
        'N':23, 'O':24, 'P':25, 'Q':26, 'R':27, 'S':28, 'T':29, 'U':30, 
        'V':31, 'W':32, 'X':33, 'Y':34, 'Z':35
    }
    counter = 0
    result = 0
    for x in value:
        result += characterWeight[str(x)] * weighting[counter%3]
        counter += 1
    return str(result%10)

def calculateMRZ( passportNumber, DOB, expiry ):
    """
    DOB and expiry are formatted as YYMMDD
    """
    passportCheck = calculateChecksum( passportNumber )
    DOBCheck      = calculateChecksum( DOB )
    expiryCheck   = calculateChecksum( expiry )
    mrzNumber  = passportNumber + passportCheck + DOB + DOBCheck + expiry + expiryCheck
    mrzCheck = calculateChecksum( mrzNumber ).zfill(2)
    mrz =  passportNumber + passportCheck + "XXX" + DOB + DOBCheck + "X" + expiry + expiryCheck + "<<<<<<<<<<<<<<" + mrzCheck
    return mrz

print( calculateMRZ("123456789", "841213", "220229") )

Can you read a cancelled passport?

I would have thought that cutting the cover of the passport would destroy the antenna inside it. But, going back to the UK guidance:

You must not cut the back cover on the ePassport

Ah! That's where the NFC chip is. I presume this is so that cancelled passports can still be verified for authenticity.

Cryptography and other security

The security is, thankfully, all fairly standard Public Key Cryptography - 9303 part 11 explains it in excruciating levels of detail.

One thing I found curious - because the chip has no timer, it cannot know how often it is being read. You could bombard it with thousands of password attempts and not get locked out. Indeed, the specification says:

the success probability of the attacker is given by the time the attacker has access to the IC, the duration of a single attempt to guess the password, and the entropy of the passport.

Can you brute-force a passport?

Wellllll… maybeeeee…?

Passports are generally valid for only 10 years. So that's 36,525 possible expiry dates.

Passport holders are generally under 100 years old. So that's 3,652,500 possible dates of birth.

That's already 133,407,562,500 attempts - and we haven't even got on to the 1E24 possible passport numbers!

In my experiments, sending an incorrect but valid MRZ results in the chip returning "Security status not satisfied (0x6982)" in a very short space of time. Usually less than a second.

But sending that incorrect attempt seemed to introduce a delay in the next response - by a few seconds. Sending the correct MRZ seemed to reset this and let the chip be read instantly.

So, if you knew the target's passport number and birthday, brute forcing the expiry date would take a couple of days. Not instant, but not impossible.

Most commercial NFC chips support 100,000 writes with no limit for the number of reads. Some also have a 24 bit read counter which increments after every read attempt. After 16 million reads, the counter doesn't increment. It could be possible for a chip to self-destruct after a specific number of reads - but I've no evidence that passport chips do that.

Is it worth brute-forcing a password?

If you were to brute-force the MRZ, you would discover the passport-holder's date of birth. You would also get:

• A digital copy of their photo,
• Their full name,
• Their sex²,
• The country which issued their passport, and
• Their nationality.

All of that is something which you can see from looking at the passport. So there's little value in attempting to read it electronically.

Installing

As mentioned, I'm using https://github.com/roeften/pypassport

The only library I needed to install was pyasn1 using pip3 install pyasn1 - your setup may vary.

Download PyPassport. In the same directory, you can create a test Python file to see if the passport can be read. Here's what it needs to contain:

from pypassport import epassport, reader

#   Replace this MRZ with the one from your passport
MRZ = "1234567897XXX8412139X2202299<<<<<<<<<<<<<<04"

def trace(name, msg):
    if name == "EPassport":
        print(name + ": " + msg)

r = reader.ReaderManager().waitForCard()

ep = epassport.EPassport(r, MRZ)
ep.register(trace)
ep.readPassport()

Plug in your NFC reader, place your passport on it, run the above code. If it works, it will spit out a lot of debug information, including all the data it can find on the passport.

Getting structured data

The structure of the passport data is a little convoluted. The specification puts data into different "Data Groups" - each with its own ID.

By running:

ep.keys()

You can see which Data Groups are available. In my case, ['60', '61', '75', '77']

• 60 is the common area which contains some metadata. Nothing interesting there.
• 61 is DG1 - the full MRZ. This contains the holder's name, sex, nationality, etc.
• 77 is the Document Security Object - this was empty for me.
• 75 is DG2 to DG4 Biometric Templates - this contains the image and other metadata.

Dumping the biometrics - print( ep["75"] ) - gives these interesting pieces of metadata:

'83': '20190311201345',
'meta': {   'Expression': 'Unspecified',
            'EyeColour' : 'Unspecified',
            'FaceImageBlockLength': 19286,
            'FaceImageType': 'Basic',
            'FeatureMask': '000000',
            'FeaturePoint': {0: {'FeaturePointCode': 'C1',
                                'FeatureType': '01',
                                'HorizontalPosition': 249,
                                'Reserved': '0000',
                                'VerticalPosition': 216},
                            1: {'FeaturePointCode': 'C2',
                                'FeatureType': '01',
                                'HorizontalPosition': 141,
                                'Reserved': '0000',
                                'VerticalPosition': 214}},
            'Features': {},
            'Gender': 'Unspecified',
            'HairColour': 'Unspecified',
            'ImageColourSpace': 'RGB24',
            'ImageDataType': 'JPEG',
            'ImageDeviceType': 0,
            'ImageHeight': 481,
            'ImageQuality': 'Unspecified',
            'ImageSourceType': 'Static Scan',
            'ImageWidth': 385,
            'LengthOfRecord': 19300,
            'NumberOfFacialImages': 1,
            'NumberOfFeaturePoint': 2,
            'PoseAngle': '0600B5',
            'PoseAngleUncertainty': '000000',
            'VersionNumber': b'010'
        }

If I understand the testing document - the "Feature Points" are the middle of the eyes. Interesting to see that gender (not sex!) and hair colour are also able to be recorded. The "PoseAngle" represents the pitch, yaw, and roll of the face.

Saving the image

Passport images are saved either with JPEG or with JPEG2000 encoding. Given the extremely limited memory available photos are small and highly compressed. Mine was a mere 19KB.

To save the image, grab the bytes and plonk them onto disk:

photo = ep["75"]["A1"]["5F2E"]
with open( "photo.jpg", "wb" ) as f:
   f.write( photo )

As expected, the "FeaturePoints" co-ordinates corresponded roughly to the centre of my eyes. Nifty!

What didn't work

I tried a few different tools. Listed here so you don't make the same mistakes as me!

mrtdreader

The venerable mrtdreader. My NFC device beeped, then mrtdreader said "No NFC device found."

I think this is because NFC Tools haven't been updated in ages.

Jean-Francois Houzard's and Olivier Roger's pyPassport

I looked at pyPassport but it is only available for Python 2.

beaujean's pyPassport

This pypassport only checks if a passport is resistant to specific security vulnerabilities.

d-Logic

Digital Logic's ePassport software only works with their hardware readers.

Android reader

tananaev's passport-reader - works perfectly on Android. So I knew my passport chip was readable - but the app won't run on Linux.

Is it worth it?

Yeah, I reckon so! Realistically, you aren't going to be able to crack the MRZ to read someone's passport. But if you need to gather personal information³, it's perfectly possible to do so quickly from a passport.

The MRZ is a Machine Readable Zone - so it is fairly simple to OCR the text and then pass that to your NFC reader.

And even if the MRZ is gone, you can reconstruct it from the data printed on the passport.

Of course, this won't be able to detect fraudulent passports. It doesn't check against a database to see if it has been revoked⁴. I don't think it will detect any cryptographic anomalies.

But if you just want to see what's on your travel documents, it works perfectly.

It's a cheap and light plastic box with a short USB cord. When you plug it in, there's a flashing light which can't be disabled. When it is powered up, or it detects and NFC chip, it makes this weird and scratchy beep:

On Linux, it shows up as: 072f:223b Advanced Card Systems, Ltd ACR1252 Dual Reader

To get it working, install PCSC Tools and the PCSC Daemon:

sudo apt install pcsc-tools pcscd

To start the daemon:

service pcscd start

Running pcsc_scan detected the reader as two readers - PICC and SAM

Using reader plug'n play mechanism
Scanning present readers...
0: ACS ACR1252 1S CL Reader [ACR1252 Dual Reader PICC] 00 00
1: ACS ACR1252 1S CL Reader [ACR1252 Dual Reader SAM] 01 00

Putting tokens on and off the reader showed them being detected and removed.

Despite my best efforts, I was unable to get this working with libnfc.

nfc-list uses libnfc 1.8.0
No NFC device found.

For reading and writing basic NDEF tags, I used Wakdev's NFC tools, I was also able to use various Python scripts like PCSC NDEF

It also worked with a FIDO2 / HID Bridge so I could use an MFA token.

There's lots of documentation about the reader and its API as well as some official ACS Linux tools. In theory it supports firmware update - although none have been released.

It's a cheap and cheerful device. It would be nice if there were a way to stop the flashing LED and crappy buzzer.

I'm also not a fan of PassKeys⁰. It feels weird to me that my computer is the password. I get the theoretical way it works - but it rubs me up the wrong way.

So, Yubikeys? I find them an annoyance. I never have my keys to hand - which sort of defeats the purpose of them.

A little while ago, I wondered "Where are the U2F Rings?" If I could have a wearable MFA token, that would solve many of my issues¹.

Enter the Cybernetic Z1 Encrypter Ring. It is a US$300 zirconia ring with a built-in range of JavaCard-based NFC apps - including the ability to unlock your Tesla². It is powered by the VivoKey Apex chip (NXP JCOP 4 P71) which provides all the security and functionality. Your money also gets you an NFC reader/writer which connects to your computer via USB. The team have sent me a demo version of the ring to review on the proviso that I give them feedback.

Demo

Here's a quick video showing how it works:

The Good

It works! Seriously, in a world of vapourware and vaguely-worded Kickstarters, it is refreshing to have a product which actually delivers. I was able to enrol it on my BitWarden account and then use it to log in - all via my Android phone. Similarly, I tested it working with Amazon, BitWarden, CodeBerg, Discord, Gandi, GitLab, GoDaddy, Google, PorkBun, Proton, WordPress and a few others.

It's a good looking, plainly designed, unibody ring. It is waterproof and survived the daily abuse I give my hands. It was washed with soap and blasted with a hand-dryer and it kept on chugging. No need to recharge it either - NFC runs off the power of radio waves like magic.

It is completely smooth, no built in scanners or LEDs or power-ports. The antenna appears to be all the way around the ring - so you can use either side of your finger on a scanner.

There is an Android app which you can use to send information to the ring. That's designed for being able to share contact details and has a generous 4KB of storage³.

But, the nice thing is, you don't need the app! By default the ring will work as a FIDO2 token suitable for logging in to a variety of services.

The code on the Ring is (somewhat) Open Source. You can write your own JavaCard applets and load them on to the ring.

The Bad

It works well... until it doesn't. Mostly this is a criticism of FIDO2. I initially was unable to use the ring with GitHub: I tried both Firefox and Chrome but got the same error. Similarly, CoinBase wouldn't register the key and didn't tell me why.

I contacted the Ring's manufacturer and they sent me details of a firmware update which claimed to fixed the issue.

Google worked - but gave me this rather weird default name and icon: I was able to rename it, but the icon can't be changed.

Amazon had the same issue, but with no way to rename.

Both LinkedIn and WhatsApp would only let me create a phone-based PassKey. They didn't give me a prompt to scan my NFC ring.

NFC only is also a bit of a limitation. Until every laptop comes with built-in NFC, you'll need to use a dongle / reader if you want to use the ring. For a phone or tablet with NFC, you're fine. Well, as long as you know where your phone's NFC reader is!

The Android app isn't open source, which feels like a bit of a missed opportunity. It is pretty bare-bones, only providing the ability to add contact details and see how much free storage and RAM there is. In the future, the app promises to offer "Smart PGP" and a few other services.

The contact card stuff is a bit underwhelming. Rather than embed a VCARD, it takes users to a separate website which has your contact details on it.

Weirdly, it zips the content of your contact details and uses them to populate the website with data. Because there's only a limited amount of space available, contact images end up very pixellated. The website also uses external JavaScript without using SRI - which isn't what I'd expect from a security focussed company.

If you use a 3rd party NFC app, you can change the NDEF share to be any URl you want. I think that's probably a sensible thing to do.

Obviously, $300 is a chunk of change. You can buy a basic U2F USB/NFC key for £20 - £50. So, with this, you're paying a higher price for a small-run product with a niche form-factor.

The Ugly?

Do you want to wear jewellery? The Z1 is plain black and unobtrusive - unlike the garish designs of some fashion rings - but perhaps a few different styles and colours would be nice?

I already wear a wedding ring, so having another to wear wasn't too much of an adjustment. The ring comes in a number of US ring sizes, so you may need to compensate if you're used to a different sizing system. However, it is a bit of a chunky beast. You will certainly notice it while wearing it.

Would an attacker rip it off your finger or even chop your finger off? It is a niche risk - but if you're using this to digitally safeguard your billions of crypto-riches, worth thinking about.

Updates

The Z1 Encrypter runs JavaCard applets so, in theory, you can load any compatible app onto it. By default, it runs Bryan Jacobs' FIDO2Applet. It recently received an update which should make it work with GitHub.

To install or update apps, you'll need the Fidesmo Android app or iOS app.

WARNING! Before installing a new app, you have to destroy the old one. This will wipe all your previous registrations.

However, I just couldn't get this to work. I tried using the Fidesmo app to uninstall the Tesla applet - but it failed.

Despite it asking me to uninstall again, there was no option to do so.

I find it a bit weird that the Ring relies on a 3rd party app to do this. I'd much rather see it built into the same app which controls the ring.

Security

By default, the ring has no password set on its internal memory. That means you can write whatever content you want to the NDEF share. Of course, this means someone sat next to you can also change your saved URl! If you use the Fidesmo app, you can lock the contents of the share. Once locked it cannot be overwritten unless you destroy the applet.

So I was able to change the default URl to one I controlled, and I was able to lock it.

But anyone with the Fidesmo app can delete any applet on your ring. Simply open the app, tap the phone against the ring to read the data, select the app you want to delete, and hold the phone against the ring for a few seconds.

It isn't unobtrusive. You'd probably notice someone clutching your hand for a several seconds. But you probably wouldn't notice if you were asleep.

The only damage is rendering your PassKey inoperable. So you would have to revert back to using a different 2FA method. An attacker couldn't steal your data, but they could provide a denial of service attack on you.

It would be great if the ring came with a password. However, there is the risk that if you lost your own password, you'd be unable to write data to it.

I am unqualified to audit the hardware security. If an attacker had physical access to the Ring, could they crack it open and extract the keys from hardware? I don't know.

Linux Support & Open Source

The Cybernetic website says the Z1 supports "iOS, Android, Windows. MacOS coming June 2024." But how well does it work with Linux?

There are several open source tools repositories available from VivoKey - although none specifically related to the ring.

I took a look at a bunch of compatible readers and got the ACR1252u-MF (full review later). There are a couple of Linux utilities which claim to work as NFC U2F readers - but the only one I could get working was Bryan Jacob's FIDO2 HID Bridge. Installing was a bit of a faff (yay various Python incompatibilities) and using it means invoking an obscure command on the terminal. But... it worked!

I registered the ring on a service using my Android device, then I was able to sign in to the same service using Firefox on Linux!

Even better - I was finally able to register the ring with GitHub! And, once I'd registered it using Linux, I could sign on with Android. HASHTAG INTEROPERABILITY!

The Broken

And then I kinda broke it. Somehow, the Fidesmo app ended up locking the entire card. Everything still worked - both NDEF and WebAuthN - but I couldn't update the firmware or applets. On the one hand, no one can wipe my OS! But on the other, I can't load new software or fix any bugs.

NFC is fragile technology. Send the wrong obscure command to the device and it will behave unpredictably.

Final Verdict

For a certain type of nerd, this is awesome. It doesn't have aggressive "geek-chic" branding - it just quietly lets you augment your body with a useful bit of tech. Now I don't need to search for my key-ring every time I want to log into a secure service.

The flaws with this product are mostly to do with the ecosystem. Mostly.

U2F / FIDO2 / Whatever is pretty nifty technology. When it works, it is just like magic. Wave your hand near your phone and you are authenticated.

When it doesn't work, you might get stuck in a loop trying to work out why things are going wrong. It's terrifyingly easy to accidentally break something.

FIDO2 is still a pain. Do you know the difference between CTAP1 and U2F, or how they relate to WebAuthn? Does your favourite service support 2FA at all? Are you happy running a Python script on the CLI if you want to log in?

But that's not the ring's fault. It is early days for the tech and there are teething troubles.

The built-in contact-card portion of the ring is a bit daft. Pointing users to a 3rd party site doesn't seem like the right call for the type of people who'll buy this. I'm glad it could be pointed to a site that I control - albeit by using a different app to write the data.

I got used to wearing the ring after a few days, and it was the exact size that I requested. Although it is chunky, it is a subtle piece of jewellery and unlikely to draw unwanted attention. There are no LEDs or batteries to worry about.

Despite the teething issues and the price, I'm rather keen on this. Waving my hand next to my phone to exchange cryptographic information makes me feel part-way to being a cyborg-wizard. Is this the future of wearable technology? I don't know - but it is rather fun. I'm happy to be an early-adopter and to bash out the bugs in the tech.

If you want, VivoKey will also sell you an NFC Implant which you can inject under your skin and use as an MFA token. Personally, I think I'll stick with the ring!

You can buy the ring directly from Cybernetic.

So, I've been sent 20 NTAG 215s to review.

First thing's first, these cost a pound each! The 215s are in a supply shortage at the moment, but even buying in bulk, you'll only get down to about 50p per tag.

A plain white sticker, printed with black ink for a QR code, is much cheaper. But there is an undeniable magic to NFC - hover your phone nearby and something happens!

Quick Review

With an Android phone, you can quickly and easily write 504 bytes of data to a tag. There's no sticker, but they're light enough to stick to just about any surface with a dab of glue. Don't put them on metal though, or you won't be able to read the tag.

The tags can be password protected, which is handy if you want to keep the contents from being overwritten from someone without the 8 character password. You can also permanently write-lock the tags - this cannot be removed.

I tried them on a couple of Android phones and they worked quickly and easily.

They're 35mm in size, which makes them easy to spot when stuck to a surface and gives you a reasonable target size if you don't know where your phone's sensor is. They are plain white. But the surface is shiny plastic - so you can write on them with a soft pencil or a felt-tip pen.

The exact model number is NT2H1511G0DUx - which is widely compatible.

They're small enough and thin enough to hide in clothes, shoes, or anything that you might need to claim ownership of. The plastic feels pretty durable and will take some effort to break.

The price is a little high but included next-day delivery.

Tech Specs

You can read the whole specification on NXP's website.

The main things you probably care about are:

• 504 bytes of data.
• Lockable.
• Password Protected.
• Read Counter.
• Compatible with Amiibo.

504 bytes is long enough for almost any URl. Obviously, you're not going to be flinging tonnes of data around with this, but it's a little disappointing that it's not long enough for, say, a PGP key.

The tags are optionally lockable. That means that once written to, they cannot be overwritten. Ever. Handy if you're going to put them out in public. You don't have to use that feature.

Password protection means that you can set a specific memory area of the chip to require a password to overwrite. You can also set an AUTHLIM number which limits the number of authentication attempts. If you go over it, the chip self-destructs. Well, it renders the memory portion unreadable. The password has a maximum length of 8 characters.

There's a 24 bit counter to tell you how often the chip has been read. This seems like overkill - 24 bits is capable of counting to ~16 million! Still, it can be helpful to see which of your tags is most popular. If you're using a URl, you can set a counter on that as well - so it automagically appends ?ctr=000001 the first time it is scanned, ?ctr=000002 the second, etc.

Finally, the main reason people seem to buy this specific model is that it is compatible with Nintendo's Amiibo platform. If you're unaware of Amiibo - they're figurines you can buy, shaped like a game character. They have an NFC tag in their base, and when you hold them against your games console, they give you an in-game upgrade.

There are a bunch of open source tools to enable you to clone an Amiibo and write it to a fresh tag. How weird that we're now able to "pirate" physical products!

Using them

According to Adam Nybäck's open source NFC reader, the chip supports the following standards:

• NfcA
• MifareUltralight C
• Ndef

Luckily, NFC is an open protocol - so you can find lots of apps which will write data to the chips.

NXP are the manufacturer of most of the world's NFC tags, their Android app is pretty good. With a couple of taps, you can set the payload and write it to the tag.

Usability

Do you know where your phone's NFC sensor is? With a bit of trial and error you can easily find it. But if you want to use your tags to share data with other people's phones, it is a bit more complicated.

You either have to slowly and sensuously stroke the back of the phone until it gives a little jolt of excitement, or laboriously hold your tag over likely spots for a few seconds.

Because the chip is small, and lots of phones have cases which attenuate the signal, placement needs to be quite precise.

iPhones

Bloody Apple! They finally have NFC in their latest models, but you need to install an app to read tags. Once done, it is quick to scan and open tags.

There is no way to write a tag using an iPhone.

Final Word

These are basically fine. It would be nice if they had a sticker on one side. But they're thin and light. I still think QR codes are faster, better, and cheaper. But the ability to write-protect information, and the built in counters, are undeniably useful.

Perhaps next year is the year of Linux on the desktop NFC on the iPhone?

Buy! Consume! Enjoy!

Buy 20 NFC tags on Amazon for £20. Or don't. I'm not in charge.

This review unit was supplied by NiceRebate.

tl;dr Overwriting a tag can leave old data intact, and still readable.

Here's the decoded memory layout of a tag with data written to it. In this case, a (failed) experiment at storing a JavaScript pop-up.

# NDEF message:
[00] D1 01 7D 55 00 64 61 74 61 3A 74 65 78 74 2F 68 |.␁}U␀data:text/h|
[10] 74 6D 6C 3B 63 68 61 72 73 65 74 3D 75 74 66 2D |tml;charset=utf-|
[20] 38 2C 25 33 43 25 32 31 44 4F 43 54 59 50 45 25 |8,%3C%21DOCTYPE%|
[30] 32 30 68 74 6D 6C 25 33 45 25 33 43 62 6F 64 79 |20html%3E%3Cbody|
[40] 25 33 45 25 33 43 73 63 72 69 70 74 25 33 45 61 |%3E%3Cscript%3Ea|
[50] 6C 65 72 74 25 32 38 25 32 32 68 69 25 32 32 25 |lert%28%22hi%22%|
[60] 32 39 25 33 42 25 33 43 25 32 46 73 63 72 69 70 |29%3B%3C%2Fscrip|
[70] 74 25 33 45 25 33 43 25 32 46 62 6F 64 79 25 33 |t%3E%3C%2Fbody%3|
[80] 45                                              |E               |

As the experiment didn't work, I decided to rewrite the tag with some much shorter data. Here's the new message.

# NDEF message:
[00] D1 02 36 53 70 91 01 12 55 00 68 74 74 70 73 3A |.␂6Sp.␁␒U␀https:|
[10] 2F 2F 65 64 65 6E 74 2E 74 65 6C 51 01 1C 54 02 |//edent.telQ␁␜T␂|
[20] 65 6E 54 65 72 65 6E 63 65 27 73 20 63 6F 6E 74 |enTerence's␠cont|
[30] 61 63 74 20 64 65 74 61 69 6C 73                |act␠details     |

But that's not the whole story! The above is the NDEF (NFC Data Exchange Format) message which has been decoded. Let's look at the full memory layout:

# Memory content:
[00] *  04:01:2A A7 (UID0-UID2, BCC0)
[01] *  62:F4:48:81 (UID3-UID6)
[02] .  5F 48 00 00 (BCC1, INT, LOCK0-LOCK1)
[03] .  E1:10:12:00 (OTP0-OTP3)
[04] .  03 3B D1 02 |␃;.␂|
[05] .  36 53 70 91 |6Sp.|
[06] .  01 12 55 00 |␁␒U␀|
[07] .  68 74 74 70 |http|
[08] .  73 3A 2F 2F |s://|
[09] .  65 64 65 6E |eden|
[0A] .  74 2E 74 65 |t.te|
[0B] .  6C 51 01 1C |lQ␁␜|
[0C] .  54 02 65 6E |T␂en|
[0D] .  54 65 72 65 |Tere|
[0E] .  6E 63 65 27 |nce'|
[0F] .  73 20 63 6F |s␠co|
[10] .  6E 74 61 63 |ntac|
[11] .  74 20 64 65 |t␠de|
[12] .  74 61 69 6C |tail|
[13] .  73 FE 00 00 |s.␀␀|
[14] .  64 79 25 33 |dy%3|
[15] .  45 25 33 43 |E%3C|
[16] .  73 63 72 69 |scri|
[17] .  70 74 25 33 |pt%3|
[18] .  45 61 6C 65 |Eale|
[19] .  72 74 25 32 |rt%2|
[1A] .  38 25 32 32 |8%22|
[1B] .  68 69 25 32 |hi%2|
[1C] .  32 25 32 39 |2%29|
[1D] .  25 33 42 25 |%3B%|
[1E] .  33 43 25 32 |3C%2|
[1F] .  46 73 63 72 |Fscr|
[20] .  69 70 74 25 |ipt%|
[21] .  33 45 25 33 |3E%3|
[22] .  43 25 32 46 |C%2F|
[23] .  62 6F 64 79 |body|
[24] .  25 33 45 FE |%3E.|
[25] .  00 00 00 00 |␀␀␀␀|
[26] .  00 00 00 00 |␀␀␀␀|
[27] .  00 00 00 00 |␀␀␀␀|
[28] .  00 00 00 BD (LOCK2-LOCK4, CHK)
[29] .  04 00 00 FF (CFG, MIRROR, AUTH0)
[2A] .  00 05 -- -- (ACCESS)
[2B] +P FF FF FF FF (PWD0-PWD3)
[2C] +P 00 00 -- -- (PACK0-PACK1)

You can see the new data is at the start, then there is a gap, and then the remainder of the old data is present!

This is due to this line:

[05] .  36 53 70 91 |6Sp.|

The 36 is the Payload Length - in this case 0x36 bytes of data. In other words, the header says "This data is 54 bytes in length".

Most phones' built-in NFC readers grab the first part and correctly interpret it and stop there.

But using a reader like NXP Tag Info will allow you to see all of the data hidden in the tag.

So, go around scanning NFC tags (if you can find any), and see what leftover data is still present.

To ensure this doesn't happen to you, make sure to erase and format any tags before rewriting them.

Terence Eden is on Mastodon

@edent

Replying to @edentMy nails contain a URl! pic.x.com/MmOvnlqt0u

---

I have a small NFC chip sandwiched between my finger and a fake nail. NFC - Near Field Communication - is the magic which makes your contactless credit card / Oyster card work. The chip contains a tiny amount of data. When it gets near an electromagnetic source - like a phone - it begins to broadcast the data. When your phone receives the data, it does something with it.

It is important to note, that there is no special app running on my Android phone. Decoding the chip's data is built-in functionality.

The chips cost between £2 - £5 on Amazon - that's a per-nail price. There are bulk discounts available on eBay. You will also need to buy nail glue, polish (if you want a different colour), and removal fluid. The things we do for fashion, eh?

Tech Specs

The chip is made by NXP and is the NTAG213 model. More specifically, the snappily named NT2H1311G0DUx.

According to Adam Nybäck's open source NFC reader, the chip supports the following standards:

• NfcA
• Ndef - NFC Data Exchange Format
• Mifare Ultralight type C

The Ultralight C gives us 106kbps transmission speed - which may seem slow, but the chip is limited to 144 bytes of memory. Better make your URls small! The chip can be written to 10,000 times and has unlimited reads. It uses 3DES for authentication - which I don't fully understand. You can also write protect the chip once you've written data to it.

Finally, each chip also has a 7 byte unique serial number - so you can tell your phone to "do something when you see chip with ID abcd567". For that, you will need a separate app on your phone.

The app

To program the nails, you'll need an app. Jakcom's nail-specific app doesn't appear on the Play Store. Based on the poor reviews for their other app, you're not missing much! You can download it directly - but it asks for ridiculous permissions, so best avoided.

Luckily, NFC is an open protocol - so you can find lots of apps which will write data to the chips.

NXP are the manufacturer of most of the world's NFC tags, their Android app is pretty good. With a couple of taps, you can set the payload and write it to the tag.

Stick 'em on!

If, like me, you're inexperienced with applying fake nails - there's a handy tutorial:

Because you're gluing the chip to the nail, and using acetone to remove it, don't expect these to be reusable. They are relatively fragile - so find a flat bit of your fingernail to stick them to.

The included fake nails were too small for my giant hands - hence why it is stuck to my little finger.

What can it do?

I've set mine to broadcast my contact website.

There are a whole lot more functions, as this video demonstrates:

Security

There is a small security risk with some of the functions. You can tell the phone to call a number, send a text, or an email - but the user has to confirm the action.

Riskier is Bluetooth and WiFi pairing. Long seen on Bluetooth headphones, you can tell a phone to connect to a specific Bluetooth or WiFi device. Again, the user should have to confirm the action - but that will depend on the phone.

Most phones only activate NFC when the screen is on and the device unlocked - so you should be aware that something is interacting with your device.

Different models

The manufactures, Jakcom, have three different models.

• N2F - carries some "information". The phone can then use that to run an app, launch a browser, or similar. That's what I'm using.
• N2L - a light-up chip. Once your finger gets close to a power source, it will light up. Cute!
• N2M - this can, theoretically, hold any data that you can copy from an existing smartcard. So you could embed your work access pass into your thumb. The legality and practicality of this is something I've not explored.

I would love a combined N2F/L chip. I like the idea of my nails flashing multiple colours as that transmit data through the æther.

Usability

Do you know where your phone's NFC sensor is? With a bit of trial and error you can easily find it. But if you want to use your nails to share data with other people's phones, it is a bit more complicated.

You either have to slowly and sensuously stroke the back of the phone until it gives a little jolt of excitement, or laboriously hold your finger over likely spots for a few seconds.

Because the chip is small, and lots of phones have cases which attenuate the signal, placement needs to be quite precise.

Many years ago I wrote about the usability of NFC compared to QR codes - nothing much has changed. At least handing over a business card is more socially acceptable than demanding someone scan my finger.

iPhones

Bloody Apple! They finally have NFC in their latest models, but you need to install an app to read tags. Once done, it is quick.

Terence Eden is on Mastodon

@edent

Replying to @edentMy NFC finger works on iPhone!
(If you install the NXP tag reader app.) pic.x.com/K6Nmcwhbol

---

There is no way to write a tag using an iPhone.

Raw Info

After scanning the chip with the NXP TagInfo app, this is the technical readout:

-- NDEF ------------------------------

# NFC data set information:
NDEF message containing 1 record
Current message size: 59 bytes
Maximum message size: 142 bytes
NFC data set access: Read & Write
Can be made Read-Only

# Record #1: Smart Poster record:
Type Name Format: NFC Forum well-known type
Short Record
type: "Sp"
    # URI record
    type: "U"
    * protocol field: [none]
    * URI field: https://edent.tel
    # Text record
    type: "T"
    * encoding: UTF-8
    * lang: "en"
    * text: "Terence's contact details"
Payload length: 54 bytes
Payload data:

[00] 91 01 12 55 00 68 74 74 70 73 3A 2F 2F 65 64 65 |...U.https://ede|
[10] 6E 74 2E 74 65 6C 51 01 1C 54 02 65 6E 54 65 72 |nt.telQ..T.enTer|
[20] 65 6E 63 65 27 73 20 63 6F 6E 74 61 63 74 20 64 |ence's contact d|
[30] 65 74 61 69 6C 73                               |etails          |

# NDEF message:
[00] D1 02 36 53 70 91 01 12 55 00 68 74 74 70 73 3A |..6Sp...U.https:|
[10] 2F 2F 65 64 65 6E 74 2E 74 65 6C 51 01 1C 54 02 |//edent.telQ..T.|
[20] 65 6E 54 65 72 65 6E 63 65 27 73 20 63 6F 6E 74 |enTerence's cont|
[30] 61 63 74 20 64 65 74 61 69 6C 73                |act details     |

# NDEF Capability Container (CC):
Mapping version: 1.0
Maximum NDEF data size: 144 bytes
NDEF access: Read & Write
 E1 10 12 00                                     |....            |

-- EXTRA ------------------------------

# Memory size:
144 bytes user memory
* 36 pages, with 4 bytes per page

# IC detailed information:
Full product name: NT2H1311G0DUx
Capacitance: 50 pF

# Version information:
Vendor ID: NXP
Type: NTAG
Subtype: 50 pF
Major version: 1
Minor version: V0
Storage size: 144 bytes
Protocol: ISO/IEC 14443-3

# Configuration information:
ASCII mirror disabled
NFC counter: disabled
No limit on wrong password attempts
Strong load modulation enabled

# Originality check:
Signature verified with NXP public key

-- FULL SCAN ------------------------------

# Technologies supported:
ISO/IEC 14443-3 (Type A) compatible
ISO/IEC 14443-2 (Type A) compatible

# Android technology information:
Tag description:
* TAG: Tech [android.nfc.tech.NfcA, android.nfc.tech.MifareUltralight, android.nfc.tech.Ndef]
* Maximum transceive length: 253 bytes
* Default maximum transceive time-out: 618 ms


# Detailed protocol information:
ID: 04:01:2A:62:F4:48:81
ATQA: 0x4400
SAK: 0x00

# Memory content:
[00] *  04:01:2A A7 (UID0-UID2, BCC0)
[01] *  62:F4:48:81 (UID3-UID6)
[02] .  5F 48 00 00 (BCC1, INT, LOCK0-LOCK1)
[03] .  E1:10:12:00 (OTP0-OTP3)
[04] .  03 3B D1 02 |.;..|
[05] .  36 53 70 91 |6Sp.|
[06] .  01 12 55 00 |..U.|
[07] .  68 74 74 70 |http|
[08] .  73 3A 2F 2F |s://|
[09] .  65 64 65 6E |eden|
[0A] .  74 2E 74 65 |t.te|
[0B] .  6C 51 01 1C |lQ..|
[0C] .  54 02 65 6E |T.en|
[0D] .  54 65 72 65 |Tere|
[0E] .  6E 63 65 27 |nce'|
[0F] .  73 20 63 6F |s co|
[10] .  6E 74 61 63 |ntac|
[11] .  74 20 64 65 |t de|
[12] .  74 61 69 6C |tail|
[13] .  73 FE 00 00 |s...|
[14] .  00 00 00 00 |....|
[15] .  00 00 00 00 |....|
[16] .  00 00 00 00 |....|
[17] .  00 00 00 00 |....|
[18] .  00 00 00 00 |....|
[19] .  00 00 00 00 |....|
[1A] .  00 00 00 00 |....|
[1B] .  00 00 00 00 |....|
[1C] .  00 00 00 00 |....|
[1D] .  00 00 00 00 |....|
[1E] .  00 00 00 00 |....|
[1F] .  00 00 00 00 |....|
[20] .  00 00 00 00 |....|
[21] .  00 00 00 00 |....|
[22] .  00 00 00 00 |....|
[23] .  00 00 00 00 |....|
[24] .  00 00 00 00 |....|
[25] .  00 00 00 00 |....|
[26] .  00 00 00 00 |....|
[27] .  00 00 00 00 |....|
[28] .  00 00 00 BD (LOCK2-LOCK4, CHK)
[29] .  04 00 00 FF (CFG, MIRROR, AUTH0)
[2A] .  00 05 -- -- (ACCESS)
[2B] +P FF FF FF FF (PWD0-PWD3)
[2C] +P 00 00 -- -- (PACK0-PACK1)

  *:locked & blocked, x:locked,
  +:blocked, .:un(b)locked, ?:unknown
  r:readable (write-protected),
  p:password protected, -:write-only
  P:password protected write-only

--------------------------------------

Buy! Consume! Enjoy!

Buy smart fingernails on Amazon. Or don't. I'm not in charge.

Further Reading

Tanya Fish on Make Magazine

@baybedoll@infosec.exchange

@Baybe_Doll

New nails for @defcon - 2x MiFare Classic 1K, 2x NTAG 210, 1x NTAG 213, 1x NTAG 215 (as Princess Peach Amiibo), 1x ICODE SL2 ICS20, and 4x NFC LED #DefconNails #DEFCON26 pic.x.com/CCmFF7n4z9

---

You can also view the unboxing on YouTube

This is a card-holder with space for 6 cards - wrapped up in a protective bundle, secured with strong magnets.

Let's get the price out of the way first, this wallet costs £80. That's not Gucci levels of extravagance, but it is more expensive than any wallet I've had so far. What makes it so pricey? It is build out of woven carbon fibre - that makes it lightweight and incredibly strong.

Gorgeous

The woven fibre design is sleek and subtle. It feels great in the hand, just the right amount of texture. The case catches the light and makes for a pleasant change from dull leather.

The edges are ridged - which helps it feel secure in your hand. This isn't as slippery as it looks.

As you can see in the video, the action of the mechanism is superb. It takes a little effort to open but snap when it does is perfect. Those strong magnets keep everything in place, with no worries that the cards will fall out.

Strong

I haven't tested the device to destruction, but there's no flex when pressure is applied to it. It won't crush, deform, bend, or break.

It appears to be fairly scratch resistant as well. It spent a day in my pocket with a couple of keys and some coins. This is what it looked like afterwards:

Unblemished!

Modular

It's about the same size as a pack of cards. But you can change that! The individual card holders are secured by some reasonably strong magnets.

The price for extra inserts is US$30 each - again, a bit pricey - but they're durable and double sided. Two cards fit in every one.

Personally, I've removed one of the inserts from mine so I can have an ultra-slim card holder.

Shielded

Tap-to-pay cards are a great convenience, but they're fairly easy for a fraudster to read them. The PITAKA is RFID shielded. With my test equipment I can usually read an Oyster Card through a leather wallet - once it was in this case it became invisible to my scans.

Disadvantages

It's not all good though. This is a card only wallet. There's no space for notes, coins, or pictures of your sweetheart. I'm (mostly) cashless now - but it may not be suitable for everyone. Extra layers are available which can hold paper money and coins - but they're a further expense.

The shell is extremely tough, that also makes it completely rigid. It won't deform to fit in your pockets. It is a hard surface and, if you fall on it, you'll feel it. It only weighs 80 grammes - so it isn't excessively noticeable.

The magic magnets which keep everything together will wipe your cards' magstrips. Thankfully most cards today use Chip & Pin - or are contactless - but you'll need to find somewhere else for your older cards.

Onto that shielding. The last RFID blocking wallet I purchased had a special pouch which wasn't shielded. Handy for Oyster Cards. With the PITAKA, it is all or nothing. Handy if you're paranoid.

Finally, you will need to take a bit of time to learn how to use this wallet. Opening one-handed is pretty easy to get used to - but you'll need to memorise where your cards are. On any other wallet, I open it then pick out the card I want. With this one, I have to remember which insert I want before I open it.

With all that said, it is a cracking bit of kit. It looks cool, feels brilliant, and is pretty damned secure. The cost is high, but you get a lot of high tech kit for the price.

Learn more

You can read more about the wallet on PITAKA's blog

• International readers can buy the wallet direct from PITAKA.
• UK readers can buy the wallet on Amazon UK
• PITAKA also have a range of ultra-tough phone cases available on Amazon.

I'm a long term fan of QR codes. I know some people don't like the idea of augmenting reality with specific tags for computer vision - but I do. Some people prefer RFID/NFC. Others still prefer dedicated augmented video apps.

As I've written many times before, QR codes have several substantial advantages over alternate technologies.

• QR is a free and open standard.
• Compatible with every phone with a camera.
• No need to build or use a dedicated app.
• Free to generate.

Today, in the canteen, I think I have found the quintessential example of just how radical the open simplicity of QR codes is.

Tiny sachets of salt an pepper. Created in their millions. Given away for free the world over. Each stamped with a unique ID which can be recognised easily by a computer.

For scale, this is how small they are.

Now, I'll be the first to admit that a website about salt is not the most riveting thing in the world. But that's exactly the point! The costs associated with setting this up are close to zero. Amortized over every sachet it's probably less than the cost of a grain of salt.

There's no opportunity cost lost - what else could you stick on the side of a packet that small?

I like the fact that I can instantly see nutritional information and can certainly see it being more useful on larger items. But, again, that's the point. QR codes are free - so you might as well stick them on everything.

It's this dual freedom - free to generate and free to print - which makes QR codes ubiquitous.

The main problem with NFC (aside from lack of readers, inability for a user to tell a tag is present, proximity needed, etc) is cost. Even bought in bulk, those little RFID chips have a price. Buying 20,000 of them to stick on salt packets is an extravagance an unlikely to see any ROI to offset the cost of buying the chips and changing the manufacturing process to incorporate them. Not to mention that the chips can't be recycled easily.

QR Codes? Black ink. If you're already printing onto a surface, QR codes don't require any retooling or any equipment purchases.

I know that in our modern world we often strive for technical excellence, innovation, and quality. However, where there are two relatively compatible technologies, it is usually the cheaper technology which wins.

In many of the more relaxed civilizations on the Outer Eastern Rim of the Galaxy, the Hitchhiker's Guide has already supplanted the great Encyclopaedia Galactica as the standard repository of all knowledge and wisdom, for though it has many omissions and contains much that is apocryphal, or at least wildly inaccurate, it scores over the older, more pedestrian work in two important respects. First, it is slightly cheaper; and second, it has the words "DON'T PANIC" inscribed in large friendly letters on its cover. —Hitchhiker's Guide to the Galaxy

The Internet of Things will be powered - in part - by QR codes. Try not to get too upset about it.

RFID is like cold fusion. It will revolutionise everything - and it's only five years away!
Terence Eden

And, much like cold fusion, NFC will permantently be just around the corner. It's been "The Year of NFC" since 2008. Just like it was in 2009 and in 2010.

Today the news came that Google may be abandoning QR codes in favour of NFC for its business places service. I think this is a mistake and that NFC is too far away to be of any real use. Indeed, I think NFC will permanently be too far away.

That said, NFC technology is awesome. It has a serious cool factor going for it which is best expressed in George Nimeh's seminal post on the subject.

The Shortcomings of NFC - A Rant In Several Parts

Mass Market Penetration

Terence Eden is on Mastodon

@edent

Must blog about this NFC nonsense. It's great tech but too far away from mass market to be of any practical use for ~5 years.

---

Matt Millar

@millarm

@edent NFC == Oyster card. I'd wager that 100x more people in london have _used_ NFC than have used QR codes

---

Let's not dispute that NFC has found its way into the pockets of millions of people - via Oyster Cards and credit cards. But how many people have an NFC phone? None. Or as near to none as makes no difference.

I first saw NFC demo'd several years ago by Nokia. Once again, they had a killer technology embedded into a handset and - once again - they failed to follow it up. Today, only one Nokia phone has an NFC chip, the C7. But the chip is disabled until a future software update.

Even if every phone sold from today onwards were to contain NFC - how long would it take to get decent market penetration? Given that the majority of contracts in the UK are 18 - 24 months, you're looking at a lead time of at least two years before there's any real traction in the market. Not to mention that many people keep their old phones forever! Take a look in your mobile website's logs - you'll be confounded by the amount of phones which are several years old.

What do QR codes require? A camera and the ability to run apps. AKA every phone sold over the last 5 years.

(Incidentally, Nokia - once again - screwed things up for the industry by putting a QR reader on the N95 and then excluding the software from every subsequent phone.)

It's a hell of a lot easier to get a piece of software on a phone than to upgrade it. It's also a hell of a lot cheaper.

Cost

There are two aspects to the cost issue with NFC.

Handset Cost

The chips required within a phone cost a non-trivial amount of money. So does all the testing needed to make sure the hardware and software work. Even if you don't embed the chip in the phone, distributing NFC capable covers is a huge cost - let alone getting customers to buy them and fit them. Perhaps Operators could distribute NFC SIM cards?

Terence Eden is on Mastodon

@edent

Another problem with NFC is hardware. With 18-24 month contracts, it'll be years before there's a sufficient market. QR just needs a camera.

---

ianVisits

@ianvisits

@edent You can get NFC enabled SIM cards though. Operators could (in theory) offer upgraded SIM cards and get mass-market scale in weeks.

---

There are two problems with this

1. The cost of sending out over 60 million SIMs to every phone in the UK is expensive.
2. NFC SIM cards generally place an NFC tag in your phone - they don't allow you to read other tags.

Even if you could send a SIM card to everyone - and good luck finding those crucial PAYT handsets - you couldn't read other tags. Should that become possible it would take a massive effort to test the chip in the thousands of phone models out there.

The Cost Of QR Readers

Free. Now, the point about testing is still valid. But it's generally cheaper for a manufacturer to licence and embed software than it is to buy silicon chips, solder them in, and then licence and embed NFC software.

For the end user who purchased a phone without an QR reader - they can choose from dozens of free readers for thousands of different phones.

• BeeTagg (mobile friendly site)
• Kaywa Reader (mobile friendly site)
• I-Nigma (mobile friendly site)
• Neo Reader (mobile friendly site)
• Google's ZXing (mobile friendly site)
• QuickMark (non-mobile site).
• HyperTouch for Android

...and many more.

The Cost of NFC tags for Providers

Imagine that you want to embed a cool NFC tag in your beermat. While the cost of NFC tags is coming down - they're still very expensive. Shopping around shows single tags for around £2.00 each! When buying in significant bulk, that can go down to around 30p per tag. Which, if you're printing thousands of posters, beermats or whatever quickly adds up.

That doesn't include the cost of the NFC writer to program your tags. Nor the cost of testing each tag to see whether it works.

Nor does it include retooling your manufacturing or printing chain to either include the tags or stick them on with an adhesive.

If you're just a hobbyist, a tag set up will cost around $100.

All in all, that's a fairly hefty investment compared to QR codes.

The Cost of QR Codes for Providers

Black Ink.

That is all.

If you're already printing posters, beer mats, decals, labels, packaging, or anything else - you may have to spend a few fractions of a penny on a drop more black ink.

It's free to create codes and it's free to print codes.

Usability

QR, I'll grant you, can give the impression of poor usability.

Terence Eden is on Mastodon

@edent

The problem I have with NFC is that it requires an image or logo so you know there's an NFC tag available. Why not make that logo a QR code?

---

Alex Gibson

@alex_gibson

Replying to @edent@edent then you have to open camera, get a steady, focused pic, process image etc. NFC could simplify the whole process to a single action?

---

QR scanning on most phones is pain free. With more modern phones like Android, you can see how "Quick Response" codes got their name. It's incredibly quick. Usually under two seconds. NFC clearly has the advantage here in that they are regularly sub-second. But that's not the whole story.

Excuse me while I launch into a table...

Is There An RFID Tag Here?

Which leads me on to the gripe which got me blogging.

Terence Eden is on Mastodon

@edent

The problem I have with NFC is that it requires an image or logo so you know there's an NFC tag available. Why not make that logo a QR code?

---

How can I tell if a poster or a beermat has an RFID tag for me to scan? There are a bunch of RFID logos - none of which look very customer friendly to me.

What we need is an identifying mark which we can quickly and cheaply print on anything with an RFID tag. Perhaps something easily identifiable. Perhaps something that can easily be read by non-NFC devices...

Perhaps.... Can you see where I'm going with this?

There have already been trials of combined QR / NFC posters in Frankfurt.

Final Thoughts

NFC is an expensive solution to an already solved problem. The technical challenges and usability hurdles it presents are non-trivial.

While I've no doubt that NFC will become important in the coming years, I don't think it can surmount QR in the medium future.

Lest we forget, Motorola first started trialling NFC back in 2004. And where are we today? Still at exactly the same trial stage 7 year later. That's why I say that NFC is like cold fusion; permanently "just around the corner".

NFC is cool but QR codes are convenient and cheap. While Arthur C Clarke was right about advanced technology being indistinguishable from magic, I defer to Douglas Adams' judgement in this matter.

The Hitchhiker's Guide has already supplanted the great Encyclopaedia Galactica as the standard repository of all knowledge and wisdom, for though it has many omissions and contains much that is apocryphal, or at least wildly inaccurate, it scores over the older, more pedestrian work in two important respects.

First, it is slightly cheaper; and second, it has the words "DON'T PANIC" inscribed in large friendly letters on its cover