Campus ID News
Card, mobile credential, payment and security
caseforcontactless 1

Contactless vs. Prox: A campus perspective on security

Northern Arizona upgrades campus card from prox

Andrew Hudson   ||   Jun 24, 2015  ||   ,

There are a number of reasons for a university to consider changing its campus card whether it’s new aesthetic designs, new card technologies or a current system simply reaching the end of its intended lifespan.

Whatever the reason, however, when the decision involves a change of card technology, the contactless smart card always seems to be a topic of discussion. It’s a decision that many universities and colleges grapple with, weighing the pros and cons of a more robust card technology with the cost its implementation will require.

For many universities, the jump to contactless comes down to three main considerations. “It’s stronger card technology with encryption to prevent counterfeiting, additional functionality, and future proofing the campus,” says Brett St. Pierre, director of education solutions at HID Global.

Understanding the difference

Despite the more secure card technologies available to universities, many still rely on the so-called convenience technologies of mag stripe, bar code and prox.

At its core, the 125 kHz prox card is created for the purpose of convenience. It’s great for providing a student quick access to an academic building, residence hall or rec center, but it’s doesn’t have the same security capabilities of a 13.56 MHz contactless card.

“Proximity is a 30-year old technology that does not have security built into the communication,” says St. Pierre.

Like bar codes and mag stripes, the lack of cryptographic capabilities leaves proximity cards susceptible to cloning and counterfeiting. Smart cards – both contact and contactless – contain integrated circuits or chips that virtually eliminate the potential for card cloning via cryptographic controls. “With contactless smart card technology, you get a hand shake that is much more secure,” explains St. Pierre.

St. Pierre goes on to explain that contactless smart cards also provide the ability to store multiple identities or credential numbers. “Multiple identities can provide a university ID for use on campus, a medical center ID and third-party research labs,” he adds.

This flexibility enables a campus to tether additional functionality to its credentials beyond just physical access. “With contactless smart cards, you open the door to many more uses on campus, including physical access control, payments, library, logical access, mobile and transit functionality just to name a few,” says St. Pierre.

In addition to the added functionality, the ability to add multiple applications helps an issuer to future proof the system. Building in flexibility to address unforeseen needs that may arise during the life of the program, provides peace of mind and improves the overall return on investment.

Removing vulnerabilities at Northern Arizona

Northern Arizona University recently made the jump from prox cards to contactless smart cards. “As we became aware of vulnerabilities and limitations with proximity chip technology, we began to investigate options for a more secure and future-resistant technology,” says Joe Harting, systems administrator for campus services and activities at Northern Arizona University (NAU).

Last year, Northern Arizona was the subject of an on-campus demonstration wherein the university’s then-prox credentials were shown to be vulnerable to counterfeiting.

Harting says that he and the administration were aware of prox’s vulnerability to the “bump-and-clone” attack that made headlines, and that they had been making plans to migrate to contactless for some time. “Prox technology lends itself to cloning using inexpensive materials purchased on the Internet,” he says.

To better paint the picture, the bump-and-clone attack goes something like this:

Depending on the type of equipment used, a prox card can be read at varying distances, through wallets, purses, backpacks, etc. without the victim being aware their card was scanned. Once the prox data is read, it can be transferred to another prox card or prox-emulating device.

As long as the data from the victim’s card is identical, there is no need to decipher anything, says Harting. “Once the raw data from a credential is presented to a prox reader, it will treat it the same, whether it is the original credential or a clone.”

One of the security features of contactless smart cards prevents such attacks. By cryptographically challenging the card’s chip prior to any transaction, a reader can identify a cloned card and deny its attempted use.

While NAU was already planning a jump to contactless cards, the demo on campus expedited the transition. “We had no instances of anyone experiencing any theft or unauthorized access as a result of the vulnerabilities with prox, but we believe in taking a proactive approach to overall campus safety,” says Harting.

Related Posts

Subscribe to our weekly newsletter


Mashgin kiosk
Mar 01, 24 /

Dartmouth deploys new AI-enabled POS kiosks for self-checkout

  At Dartmouth’s Tuck School of Business in Hanover, NH, the dining hall includes a new touchless self-service kiosk that reduces checkout times dramatically. By eliminating human interaction, item handling, and barcode scanning, transactions times have been cut to as little as 10 seconds. The kiosks are from Mashgin, a Palo Alto-based company that has […]
facial recognition in college classroon

Is facial recognition on campus moving from access control to the classroom?

Facial recognition already unlock phones, expedites airport passage, and replaces IDs for door access, but now it’s efficacy is being testing in college classrooms. Chafic Bou-Saba teaches information systems at Guilford College. He believes he can improve student academic performance via cameras and AI. He and a team of students are designing a facial recognition […]
Feb 28, 24 /

Cal Poly pilots reusable dining containers to curb waste

Students at Cal Poly have been pushing for green initiatives on the San Luis Obispo campus, and dining services is listening. A new pilot program will test reusable containers in an effort to reduce waste from disposable take-out boxes. “The program greatly reduces resource consumption on campus while diverting single-use containers from landfills,” says a […]
CIDN logo reversed
The only publication dedicated to the use of campus cards, mobile credentials, identity and security technology in the education market. CampusIDNews – formerly CR80News – has served more than 6,500 subscribers for more than two decades.

Feb. 1 webinar explores how mobile ordering enhanced campus life, increased sales at UVA and Central Washington @Grubhub @CBORD

Join Jeff Koziol and Robert Gaulden from @AllegionUS as we explore how mobile credentials and proptech are changing on- and off-campus housing.

Load More...
CampusIDNews is published by AVISIAN Publishing
315 E. Georgia St.
Tallahassee, FL 32301[email protected]
Use our contact form to submit tips, corrections, or questions to our team.
©2024 CampusIDNews. All rights reserved.