Campus ID News
Card, mobile credential, payment and security
caseforcontactless 1

Contactless vs. Prox: A campus perspective on security

Northern Arizona upgrades campus card from prox

Andrew Hudson   ||   Jun 24, 2015  ||   ,

There are a number of reasons for a university to consider changing its campus card whether it’s new aesthetic designs, new card technologies or a current system simply reaching the end of its intended lifespan.

Whatever the reason, however, when the decision involves a change of card technology, the contactless smart card always seems to be a topic of discussion. It’s a decision that many universities and colleges grapple with, weighing the pros and cons of a more robust card technology with the cost its implementation will require.

For many universities, the jump to contactless comes down to three main considerations. “It’s stronger card technology with encryption to prevent counterfeiting, additional functionality, and future proofing the campus,” says Brett St. Pierre, director of education solutions at HID Global.

Understanding the difference

Despite the more secure card technologies available to universities, many still rely on the so-called convenience technologies of mag stripe, bar code and prox.

At its core, the 125 kHz prox card is created for the purpose of convenience. It’s great for providing a student quick access to an academic building, residence hall or rec center, but it’s doesn’t have the same security capabilities of a 13.56 MHz contactless card.

“Proximity is a 30-year old technology that does not have security built into the communication,” says St. Pierre.

Like bar codes and mag stripes, the lack of cryptographic capabilities leaves proximity cards susceptible to cloning and counterfeiting. Smart cards – both contact and contactless – contain integrated circuits or chips that virtually eliminate the potential for card cloning via cryptographic controls. “With contactless smart card technology, you get a hand shake that is much more secure,” explains St. Pierre.

St. Pierre goes on to explain that contactless smart cards also provide the ability to store multiple identities or credential numbers. “Multiple identities can provide a university ID for use on campus, a medical center ID and third-party research labs,” he adds.

This flexibility enables a campus to tether additional functionality to its credentials beyond just physical access. “With contactless smart cards, you open the door to many more uses on campus, including physical access control, payments, library, logical access, mobile and transit functionality just to name a few,” says St. Pierre.

In addition to the added functionality, the ability to add multiple applications helps an issuer to future proof the system. Building in flexibility to address unforeseen needs that may arise during the life of the program, provides peace of mind and improves the overall return on investment.

Removing vulnerabilities at Northern Arizona

Northern Arizona University recently made the jump from prox cards to contactless smart cards. “As we became aware of vulnerabilities and limitations with proximity chip technology, we began to investigate options for a more secure and future-resistant technology,” says Joe Harting, systems administrator for campus services and activities at Northern Arizona University (NAU).

Last year, Northern Arizona was the subject of an on-campus demonstration wherein the university’s then-prox credentials were shown to be vulnerable to counterfeiting.

Harting says that he and the administration were aware of prox’s vulnerability to the “bump-and-clone” attack that made headlines, and that they had been making plans to migrate to contactless for some time. “Prox technology lends itself to cloning using inexpensive materials purchased on the Internet,” he says.

To better paint the picture, the bump-and-clone attack goes something like this:

Depending on the type of equipment used, a prox card can be read at varying distances, through wallets, purses, backpacks, etc. without the victim being aware their card was scanned. Once the prox data is read, it can be transferred to another prox card or prox-emulating device.

As long as the data from the victim’s card is identical, there is no need to decipher anything, says Harting. “Once the raw data from a credential is presented to a prox reader, it will treat it the same, whether it is the original credential or a clone.”

One of the security features of contactless smart cards prevents such attacks. By cryptographically challenging the card’s chip prior to any transaction, a reader can identify a cloned card and deny its attempted use.

While NAU was already planning a jump to contactless cards, the demo on campus expedited the transition. “We had no instances of anyone experiencing any theft or unauthorized access as a result of the vulnerabilities with prox, but we believe in taking a proactive approach to overall campus safety,” says Harting.

Subscribe to our weekly newsletter


ColorID blog: Maximizing visitor management solutions

The third installment of ColorID's "Looking up to the Cloud" series examines the topic of visitor management solutions. Specifically, the role that cloud-based visitor management systems can play in creating a welcoming, convenient experience for campus visitors.
Mar 16, 23 / ,

Entrust report: Young consumers favor digital ID, seamless experience

In a recent entry to the Entrust blog, Jenn Markey, VP Product Marketing, Payments & Identity at Entrust, discussed the findings from the company's recent "Future of Identity" report. The report was compiled by the Entrust Cybersecurity Institute and sought to characterize consumer thoughts on passwordless authentication, hybrid identities, and ownership over personal identity information.

Expanding access control despite limited funds

There's never a shortage of desire to upgrade campus security and access control infrastructure, but securing the funding for such projects can be tricky business. In the third installment of his "Top Tips" series, ASSA ABLOY's Tyler Webb discusses some creative ways that universities source funding and pay for access control technology on campus.
CIDN logo reversed
The only publication dedicated to the use of campus cards, mobile credentials, identity and security technology in the education market. CampusIDNews – formerly CR80News – has served more than 6,500 subscribers for more than two decades.

Join us, @NACCUorg, and @TouchNet to explore how campus card programs can successfully navigate the sales and procurement process. Join the webinar on June 6, 2 pm EDT.

Webinar: Learn how the University of Arizona uses campus cards, mobile ordering, kiosks, lockers, and robots to revolutionize campus dining. April 7, 2-2:30 EDT. Register Now at

As supply chain issues in 2021 persist, identity solutions provider @ColorID discusses ways campuses can to overcome potentially troublesome delays until the situation eases.

A dining services push at the @UBuffalo is reinforcing the utility of self-service checkout. @CBORD is improving the food service experience using the GET app, as well as Nextep kiosks and Oracle’s Micros Simphony POS.

Did you miss our recent webinar? No worries - watch it on-demand. Leaders from @NAU and the @UAlberta joined Ryan Audus, Touchnet, and Andrew Hudson, @CR80News, to discuss innovative mobile services and the future of mobile tech in higher ed. Watch now:

Load More...
CampusIDNews is published by AVISIAN Publishing
315 E. Georgia St.
Tallahassee, FL 32301[email protected]
Use our contact form to submit tips, corrections, or questions to our team.
©2023 CampusIDNews. All rights reserved.