Dan Mullen, president of AIM Global, a trade association representing RFID and other data collection technology manufacturers, argues that most RFID tags don't contain personal information in the first place.
Even if they do, he said, personal data may be safer there than on a retailer's computer systems - given highly publicized breaches of those servers during the past few years.
"If somebody is looking to steal personal information, there are probably richer sources" than RFID tags, he said.
Mullen argued that RFID tags can enhance security, too. For example, they make it more difficult to forge documents - such as tickets to the 2008 Olympics. He also noted that critics voiced similar complaints when the bar code was first deployed.
But RFID skeptics note several key differences between the two technologies. The most important: Unlike a bar code, an RFID tag doesn't have to be visible for a sensor to detect it.
"You're making available over the airwaves something that's previously available only through line of sight," said Hopkins' Avi Rubin.
"The threat model changes. It's a lot more important to get the security right."
The distance at which an RFID tag can be read varies - from mere centimeters on no-swipe credit cards to hundreds of feet for tollbooth tags.
For many applications, Tien said, all you have to do is "follow somebody into an elevator. You're close enough."
Most RFID tags are passive - they don't carry their own power source but use the energy from the signal emitted by the reader to function. That eliminates the use of encryption to protect their data, Felton said.
"Encryption is a computation that requires more power and more time," he said. "Sometimes it can't be done at all, and other times it drives up the cost significantly."
Retailers often use RFID to manage inventory and prevent theft. But critics say the tags aren't required after consumers leave the store with their merchandise - often unaware that the tags are still functional. The tags can be disabled, but most stores don't bother.
On one hand, promoters say, retailers could keep RFID tags on clothing they've sold previously to identify regular customers as they enter a store and offer personalized service. On the other, critics say, an RFID tag embedded in a book might tell a snoop that a reader is carrying The Communist Manifesto or Catcher in the Rye in his backpack.
