Question first: Is there any remediation for passive MITM?
I've come across examples of NFC relay attacks which use phones to get around the proximity requirement for NFC payments.
It looks something as this:
[card | phone1] ----------------------> [phone2 | terminal]
(normal operation would be [card | terminal]
).
Many papers list this as a vulnerability, but I haven't seen any decent way to mitigate against this. One mitigation that I see described is to have stricter timings on transactions, but that would easily be defeated with specialized equipment, instead of off the shelf phones. I guess if you push this, you could in theory limit response times so much that it'd make it physically impossible to do relaying (but then good luck making this cheap and reliable).
TL;DR: Is there any possible mitigation, or are proximity requirements in various technologies basically rubbish?