I believe there are some more secure cards, like Mifare DESFire EV3 that do provide some security. You’d be shocked how insecure most RFID readers for security cards are.

Some of that can be trivially cloned.

In the case where it was most useful to make copies they did eventually replace the system with one where the keys weren’t copy able. Which was better!

Some cards use some kind of challenge-response but are weak and are easily crackable.

Some cards have an anti-copy protection based on rolling codes, be careful with these. The idea is that when you use it to, say, open a door, the card sends a code to the reader and if correct, that code is burned and the reader replies with the next code, which is stored in the card for the next time, making every other copy (possibly including the original) unusable. If the card emulator doesn't store the rolling code, you are completely locked out.

Some cards have a proper challenge-response mechanism that works and can't be easily copied.

It's a common mix-up (people barely differentiate between the terms anymore, though I'm surprised nobody in 2 hours mentioned it yet), basically RFID is (historically) an ID; a username. Like an ID field in a database. NFC is near-field communication: bidirectional. It does challenge-response and typically runs on hardened chips. But yeah people will call NFC chips RFID and RFID chips NFC all the time. Both are waterproof devices doing radio transmissions on wireless power and you can't tell them apart without using some equipment to try and read the chip type (even if most phones can do that nowadays), so I can understand the terminology generalisation

Recent UL-C/AES disclosure too IIRC

This is not a rational purchase - most of the rule breaking done with the zero is for fun or convenience, rather than being truly illegal.

It used to be more fun before the hotels started handing out NFC unlocks with your phone.

Still, being able to send each other a key for a hotel room on Signal is a nice trick if you are traveling with a sufficiently tech savvy group of people.

Flipper Zero and its clones have always been pseudohacker nonsense. Fun little party trick I suppose.

You've surely launched a generation of perhaps-someday-responsible hackers into the world.

https://infosec.exchange/@millie/115719943870742405

> We need to normalize declaring software as finished. Not everything needs continuous updates to function. In fact, a minority of software needs this. Most software works as it is written. The code does not run out of date. I want more projects that are actually just finished, without the need to be continuously mutated and complexified ad infinitum.

Works well, and compiling modules like the epaper hacker tool is easy.

https://github.com/i12bp8/TagTinker

  > why have an official firmware if it's not at least slightly maintained.

The hardware is static so the rate of software rot is pretty low. It can effectively not be maintained as long as it's already in a stable state. Adding new features is cool and all but it also adds more bugs.

But the great thing is that there's a community, all using the same hardware, and people can fork. So people can still get those updates that they want. Maybe the only thing to do is create a community fork that is much more open but doesn't come with the same stability promises. But that can still be a lot of work, even if you get community maintainers