HID, Cisco, Oracle can stop Black Hat, so that only the bad guys know how to harm the rest of us. Shame on these companies for denying us the knowledge to protect ourselves from the vulnaribilities they leave in their products. Laws should be changed so that we can sue them for problems caused by their incompetence. Then and only then will they get serious about our security.

Can this paper be made available online or as a download so that we can learn something from it?

Typical FUD responce to problems with a technology: kill (or sue) the messenger. I doubt that these people allow open diologue even in-house.

Security-through-obscurity never works, as they will eventually learn. Hopefully it won't take disasters and death to teach it to them.

No, unfortunately, to avoid the risk of IOActive getting sued for patent infringement, which HID's letter implied would happen, the materials were yanked from the presentation and from the Black Hat papers/slides manual. Watch for a slideshow that should be up today, "Black Hat Silenced by Legal Threat." In there will be s photo of the ACLU's Nicole Ozer, holding up the manual to show the noticeable gap where this information should have appeared. You can find this stuff out online if you want to build yourself a clone, but that's not advisable, since it's illegal. RFID's risks have already been documented; see the North California's ACLU's site.

It seems the bad guys have all the fun. Rather than put the black hole in front of everyone where it will have to be addressed the impression is lets keep it secret so that it does not have to be addressed until such a time as it will cost real money not to do so. Every organization screams when their products become the subject of negative demonstrations. They fail to use such demonstrations as platforms for product improvement, they instead take it as a personal attack use knee jerk responses that leave end users open to attack for longer periods of time. Those involved in purchasing information technology services and goods have the power to change this sort of activity....spend your IT dollars with organizations that truly support their products and services. By doing this effectively those that are open to information on technology flaws and weaknesses will grow and develop a better product and a satisfied customer base. Until that time those of us that would benefit by such a demonstration are the ones that will suffer. The bad guys already have the information, HID has knowledge of the information, now the great wall of silence has dropped and only those of us truly at risk have anything to loose. Seems that governance should look at Information Technology much the same ways it does automobiles....establish a lemon law. You release a poorly designed product and you will be saddled with the cost related to those making right any damages caused by the same. Not a perfect system but would certainly be better than what is currently available to those who have the skills to find such weaknesses and point them out. Always remember and never forget, CASH IS KING. The surest way to achieve any improvement in the current system is to impact cash flow either positively or negatively. Make the things you can control count.

How can it be patent infringement for education. Especially showing security protection. How to make with no other reason, maybe gray. Patent infringement is for manufacturing for profit.

I say collect your resources to back you up on suits and go for it.

They are only intimidating you.