Campus ID News
Card, mobile credential, payment and security
caseforcontactless 1

Contactless vs. Prox: A campus perspective on security

Northern Arizona upgrades campus card from prox

Andrew Hudson   ||   Jun 24, 2015  ||   ,

There are a number of reasons for a university to consider changing its campus card whether it’s new aesthetic designs, new card technologies or a current system simply reaching the end of its intended lifespan.

Whatever the reason, however, when the decision involves a change of card technology, the contactless smart card always seems to be a topic of discussion. It’s a decision that many universities and colleges grapple with, weighing the pros and cons of a more robust card technology with the cost its implementation will require.

For many universities, the jump to contactless comes down to three main considerations. “It’s stronger card technology with encryption to prevent counterfeiting, additional functionality, and future proofing the campus,” says Brett St. Pierre, director of education solutions at HID Global.

Understanding the difference

Despite the more secure card technologies available to universities, many still rely on the so-called convenience technologies of mag stripe, bar code and prox.

At its core, the 125 kHz prox card is created for the purpose of convenience. It’s great for providing a student quick access to an academic building, residence hall or rec center, but it’s doesn’t have the same security capabilities of a 13.56 MHz contactless card.

“Proximity is a 30-year old technology that does not have security built into the communication,” says St. Pierre.

Like bar codes and mag stripes, the lack of cryptographic capabilities leaves proximity cards susceptible to cloning and counterfeiting. Smart cards – both contact and contactless – contain integrated circuits or chips that virtually eliminate the potential for card cloning via cryptographic controls. “With contactless smart card technology, you get a hand shake that is much more secure,” explains St. Pierre.

St. Pierre goes on to explain that contactless smart cards also provide the ability to store multiple identities or credential numbers. “Multiple identities can provide a university ID for use on campus, a medical center ID and third-party research labs,” he adds.

This flexibility enables a campus to tether additional functionality to its credentials beyond just physical access. “With contactless smart cards, you open the door to many more uses on campus, including physical access control, payments, library, logical access, mobile and transit functionality just to name a few,” says St. Pierre.

In addition to the added functionality, the ability to add multiple applications helps an issuer to future proof the system. Building in flexibility to address unforeseen needs that may arise during the life of the program, provides peace of mind and improves the overall return on investment.

Removing vulnerabilities at Northern Arizona

Northern Arizona University recently made the jump from prox cards to contactless smart cards. “As we became aware of vulnerabilities and limitations with proximity chip technology, we began to investigate options for a more secure and future-resistant technology,” says Joe Harting, systems administrator for campus services and activities at Northern Arizona University (NAU).

Last year, Northern Arizona was the subject of an on-campus demonstration wherein the university’s then-prox credentials were shown to be vulnerable to counterfeiting.

Harting says that he and the administration were aware of prox’s vulnerability to the “bump-and-clone” attack that made headlines, and that they had been making plans to migrate to contactless for some time. “Prox technology lends itself to cloning using inexpensive materials purchased on the Internet,” he says.

To better paint the picture, the bump-and-clone attack goes something like this:

Depending on the type of equipment used, a prox card can be read at varying distances, through wallets, purses, backpacks, etc. without the victim being aware their card was scanned. Once the prox data is read, it can be transferred to another prox card or prox-emulating device.

As long as the data from the victim’s card is identical, there is no need to decipher anything, says Harting. “Once the raw data from a credential is presented to a prox reader, it will treat it the same, whether it is the original credential or a clone.”

One of the security features of contactless smart cards prevents such attacks. By cryptographically challenging the card’s chip prior to any transaction, a reader can identify a cloned card and deny its attempted use.

While NAU was already planning a jump to contactless cards, the demo on campus expedited the transition. “We had no instances of anyone experiencing any theft or unauthorized access as a result of the vulnerabilities with prox, but we believe in taking a proactive approach to overall campus safety,” says Harting.

Related Posts

Subscribe to our weekly newsletter


Virginia Tech access control readers from Allegion

Virginia Tech's multi-year journey eliminates brass keys from campus

  At Virginia Tech, a strategically planned, multi-year process has eliminated physical keys from the campus. Brass keys have been replaced by card access in buildings and residence halls. The only remaining keys are stored in secure key boxes for security personnel and residence hall advisors to access in case of emergencies or after hours […]
Harvard CrimsonCash logo
Jun 07, 24 / , ,

Harvard to end longstanding declining balance program starting July 1

Harvard’s CrimsonCash – a declining balance program that enables students to use their campus card to make payments on and off campus – will be sunsetted in phases beginning July 1, 2024 and finishing July 1, 2025. The announcement was made in an email sent to account holders and a posting on the university’s website. At […]
ELATEC Secure Logon product review

Secure computer labs and faculty workstations with existing campus cards and mobile IDs

Eliminating usernames and passwords has positive security and convenience implications, and ELATEC’s Secure Logon solution helps campuses achieve the goal. Using your existing campus ID or mobile credential, users tap it on a reader to access shared computers and resources. In this video, ELATEC’s campus lead Rawldon Weekes, discusses Secure Logon and overviews a variety […]
CIDN logo reversed
The only publication dedicated to the use of campus cards, mobile credentials, identity and security technology in the education market. CampusIDNews – formerly CR80News – has served more than 6,500 subscribers for more than two decades.

Attn: friends in the biometrics space. Nominations close Friday for the annual Women in Biometrics Awards. Take five minutes to recognize a colleague or even yourself.

Feb. 1 webinar explores how mobile ordering enhanced campus life, increased sales at UVA and Central Washington @Grubhub @CBORD

Load More...
CampusIDNews is published by AVISIAN Publishing
315 E. Georgia St.
Tallahassee, FL 32301[email protected]
Use our contact form to submit tips, corrections, or questions to our team.
©2024 CampusIDNews. All rights reserved.