A credential is only as good as the reader behind it and the way the site issues it. 125 kHz proximity cards carry a fixed number that a handheld reader can clone; 13.56 MHz smart cards support encrypted authentication; mobile credentials move the decision onto a phone that may be dead. Choose per door and per person, not per project.
Most credential decisions are made once, badly, and then lived with for a decade. The card that was chosen because it was cheap is the reason a lost fob cannot be trusted, and the phone-first system is the reason a contractor cannot get in on a Tuesday.
The useful question is not which credential is most modern. It is who carries it, how it can be copied, and what the site does when it is lost.
Proximity cards: cheap, and easy to copy
Older 125 kHz proximity cards carry a fixed number with no mutual authentication, and a handheld device can read and clone one through a pocket. They remain in service in thousands of buildings because they work and cost little, and on an interior door with a low-value consequence that may be an acceptable trade.
The test is what a cloned card gets access to. A copy that reaches the lobby is a different problem from a copy that reaches the server room.
Smart cards and fobs: the default for a reason
13.56 MHz smart cards support encrypted, mutually authenticated exchange between card and reader, so a number scraped from the air is not enough. The format matters as much as the frequency: a card that uses only its serial number is behaving like a proximity card with a better label.
Fobs are the same technology in a form people keep on a keyring. They are easier to hand to a courier and easier to pass to a neighbour, which is an administrative problem rather than a technical one.
Mobile credentials: convenience with a battery
A phone credential lives in an app and presents over Bluetooth or near-field communication. It is excellent for staff who already carry a phone and awkward for contractors, deliveries or anyone whose phone battery dies at 6pm. Most sites run mobile alongside cards rather than instead of them.
Ask where the app gets its authority, what happens when the network is down, and who can revoke a credential at 9pm on a Sunday. A credential you cannot revoke is not a credential.
Biometrics and second factors
Fingerprint, iris and facial recognition suit doors where the consequence is high and the population is small and enrolled deliberately: cash rooms, pharmacies, records storage, server rooms. Enrollment is a real process, and a biometric that fails on a wet January morning teaches everyone to prop the door.
The practical use is usually a second factor: card plus PIN, or card plus biometric, at the doors that matter rather than at every door.
- Biometrics where the population is stable and enrollment is managed.
- A keypad PIN as a second factor, never as the only factor on an exterior door.
- Long-range or hands-free readers for parking gates and loading doors.
- A documented process for issuing, replacing and revoking every credential type.
Related:Commercial access control systems in DenverAccess credentials, defined
Frequently asked questions
Can we keep our existing cards?
Often, if the card format and the new readers match and the old system can export its data. Where they do not, dual-technology readers let old and new credentials coexist during a migration. We test a sample card before promising reuse.
Is a phone credential more secure than a card?
It can be, because it supports encrypted exchange and can be revoked remotely. It also depends on a battery and an app. Most commercial sites are best served by mobile for staff and a card or fob for everyone else.
What is OSDP and why does it matter for credentials?
OSDP is the encrypted, two-way protocol between reader and controller. Wiegand sends a card number one way and cannot report that a reader has been removed. Where the controller supports it, OSDP is the better wiring decision and it protects the credential in transit.
Related:Commercial access control systems in DenverAccess credentials, definedBrivo cloud access control
