Campus ID News
Card, mobile credential, payment and security
caseforcontactless 1

Contactless vs. Prox: A campus perspective on security

Northern Arizona upgrades campus card from prox

Andrew Hudson   ||   Jun 24, 2015  ||   ,

There are a number of reasons for a university to consider changing its campus card whether it’s new aesthetic designs, new card technologies or a current system simply reaching the end of its intended lifespan.

Whatever the reason, however, when the decision involves a change of card technology, the contactless smart card always seems to be a topic of discussion. It’s a decision that many universities and colleges grapple with, weighing the pros and cons of a more robust card technology with the cost its implementation will require.

For many universities, the jump to contactless comes down to three main considerations. “It’s stronger card technology with encryption to prevent counterfeiting, additional functionality, and future proofing the campus,” says Brett St. Pierre, director of education solutions at HID Global.

Understanding the difference

Despite the more secure card technologies available to universities, many still rely on the so-called convenience technologies of mag stripe, bar code and prox.

At its core, the 125 kHz prox card is created for the purpose of convenience. It’s great for providing a student quick access to an academic building, residence hall or rec center, but it’s doesn’t have the same security capabilities of a 13.56 MHz contactless card.

“Proximity is a 30-year old technology that does not have security built into the communication,” says St. Pierre.

Like bar codes and mag stripes, the lack of cryptographic capabilities leaves proximity cards susceptible to cloning and counterfeiting. Smart cards – both contact and contactless – contain integrated circuits or chips that virtually eliminate the potential for card cloning via cryptographic controls. “With contactless smart card technology, you get a hand shake that is much more secure,” explains St. Pierre.

St. Pierre goes on to explain that contactless smart cards also provide the ability to store multiple identities or credential numbers. “Multiple identities can provide a university ID for use on campus, a medical center ID and third-party research labs,” he adds.

This flexibility enables a campus to tether additional functionality to its credentials beyond just physical access. “With contactless smart cards, you open the door to many more uses on campus, including physical access control, payments, library, logical access, mobile and transit functionality just to name a few,” says St. Pierre.

In addition to the added functionality, the ability to add multiple applications helps an issuer to future proof the system. Building in flexibility to address unforeseen needs that may arise during the life of the program, provides peace of mind and improves the overall return on investment.

Removing vulnerabilities at Northern Arizona

Northern Arizona University recently made the jump from prox cards to contactless smart cards. “As we became aware of vulnerabilities and limitations with proximity chip technology, we began to investigate options for a more secure and future-resistant technology,” says Joe Harting, systems administrator for campus services and activities at Northern Arizona University (NAU).

Last year, Northern Arizona was the subject of an on-campus demonstration wherein the university’s then-prox credentials were shown to be vulnerable to counterfeiting.

Harting says that he and the administration were aware of prox’s vulnerability to the “bump-and-clone” attack that made headlines, and that they had been making plans to migrate to contactless for some time. “Prox technology lends itself to cloning using inexpensive materials purchased on the Internet,” he says.

To better paint the picture, the bump-and-clone attack goes something like this:

Depending on the type of equipment used, a prox card can be read at varying distances, through wallets, purses, backpacks, etc. without the victim being aware their card was scanned. Once the prox data is read, it can be transferred to another prox card or prox-emulating device.

As long as the data from the victim’s card is identical, there is no need to decipher anything, says Harting. “Once the raw data from a credential is presented to a prox reader, it will treat it the same, whether it is the original credential or a clone.”

One of the security features of contactless smart cards prevents such attacks. By cryptographically challenging the card’s chip prior to any transaction, a reader can identify a cloned card and deny its attempted use.

While NAU was already planning a jump to contactless cards, the demo on campus expedited the transition. “We had no instances of anyone experiencing any theft or unauthorized access as a result of the vulnerabilities with prox, but we believe in taking a proactive approach to overall campus safety,” says Harting.

Subscribe to our weekly newsletter


Sign saying show your ID card
Sep 29, 23 /

DePaul requires students to carry campus ID at all times on campus

Following a string of robberies on or near campus the Lincoln Park campus, DePaul University initiated a plan to tighten security. Part of the plan requires students, faculty, and staff to carry their DePaul ID at all times on campus. “Public safety officers will have the authority to remove anyone from a DePaul building who […]
Dawn Thomas, NACCU CEO, video on NACCU Near You event series
Sep 27, 23 /

CampusIDChat: NACCU launches regional NACCU Near You event series

In this edition of CampusIDChats, publisher Chris Corum catches up with Dawn Thomas, NACCU CEO, to learn about the upcoming NACCU Near You events series. Sometimes traveling to a conference is challenging due to schedules, budgets, and workloads. That is where the NACCU Near You events series fills a void. These one-day regional events offer […]
Penn State mobile credential banner
Sep 26, 23 / ,

Penn State’s mobile credential program serves students on 24 unique campuses with 81% adoption rate

  At the beginning of 2023, Penn State rolled out Transact Mobile Credential to students, faculty, and staff. Among mobile credential programs, this one stands out because it was rolled out simultaneously across all 24 campuses of Penn State. In partnership with Transact, the campus team faced a unique set of challenges presented by this […]
CIDN logo reversed
The only publication dedicated to the use of campus cards, mobile credentials, identity and security technology in the education market. CampusIDNews – formerly CR80News – has served more than 6,500 subscribers for more than two decades.

Join us, @NACCUorg, and @TouchNet to explore how campus card programs can successfully navigate the sales and procurement process. Join the webinar on June 6, 2 pm EDT.

Webinar: Learn how the University of Arizona uses campus cards, mobile ordering, kiosks, lockers, and robots to revolutionize campus dining. April 7, 2-2:30 EDT. Register Now at

Load More...
CampusIDNews is published by AVISIAN Publishing
315 E. Georgia St.
Tallahassee, FL 32301[email protected]
Use our contact form to submit tips, corrections, or questions to our team.
©2023 CampusIDNews. All rights reserved.