In this work we propose a solution to the RFID privacy problem that has the potential to guarantee user privacy without requiring changes to existing infrastructure or reducing business value from the use of RFID technology. We give emphasis to the development of a lightweight protocol that does not incur costly overheads with respect to computation, storage as well as time and effort needed for deployment configuration. For RFID technology to be widely used, security should ship as a "default" and require no significant effort to configure. We demonstrate the security and efficiency properties of our protocol and we offer some interesting time/space tradeoffs that may lead to further improvements.