Well, he stands on the paranoid side at all times by default... :-)

However, this is really ridiculous. These guys have written their software with deliberate errors, so it CAN be directly attacked by - as also Joe pointed out - ANY piece of data. This is the same, for example, as if an ATM firmware would written so that entering a particular multi-digit "PIN" would trigger dump of the whole cashbox... (see what google gives you on the topic - if you omit the newspapers, most who dare to comment point out the same, each giving a different example of such path for the data -> you can come up with zillions of examples for the same, without a single mention of RFID itself).

This does not mean that RFIDs don't have security issues - contrary, they do, and are periodically pertracted by Schneier himself. But this time, this IS an empty hype.

So, the claim really should be, "crappy programs (written in crappy languages^*) may be attacked if a user is permitted to enter any data". This won't make such a nice headline, though.

JW

---
* of course, this refers mainly to C... :-)