Note 12
Proximity is not authentication.
“The legitimate device is nearby” is a measurement claim. Authentication is a decision about who is speaking.
A large class of consumer and enterprise products now treat distance as a credential. Cars unlock. Laptops wake. Payments confirm. Doors click. The underlying radios (BLE, NFC, UWB, sometimes Wi-Fi RTT) are asked to answer a question they are only partly designed for: is the intended peer here, or is someone else occupying the same story?
What proximity can claim
A well-built ranging protocol can say something useful about geometry. It cannot, by itself, say that the cryptographic identity on the other end is the human the product had in mind, or that the measurement was not relayed through a helpful stranger. When products collapse those questions into one green check, they mint a new trust boundary and then refuse to draw it.
Where models go thin
Threat models for these systems often stop at “use industry pairing” or “UWB is hard to relay.” Pairing quality matters. Physics matters. Neither substitutes for stating the adversary: a thief with a buddy, a malicious accessory, a compromised phone on the same account, a support technician with last year’s debug dongle. Each adversary moves the boundary.
If the control is “close enough,” the attacker’s job is to become close enough in the protocol, not in the parking lot.
How NIIS 9 uses this
Proximity products are modeled as authentication systems that happen to use radios. Reviews ask what is bound: key, account, device posture, user intent, and freshness. They also ask what happens when the radio neighborhood is hostile and the user is in a hurry, because that is the actual operating environment, not a lab bench with one peer.