Why old cards are a bad idea
Three ways a card can be weak — it says a fixed number, its crypto was broken years ago, or its keys were never changed. Here's how to tell, and what to use instead.
A lot of the cards in daily use were designed when "someone reads the card from across the room" was the whole threat model. They still open doors because they still work, not because they're safe. There are three classic ways an old credential falls down.
#1. It only says a number
The weakest cards do no cryptography at all. They power up and read out a fixed value — a UID, or a Prox facility-code-and-card-number. There's no secret and no challenge, so anything that can hear the number can repeat it. A card like this can't not be copyable; copyability is baked into the design.
#2. Its crypto was broken, publicly, years ago
The next tier added encryption — but rolled their own, kept it secret, and hoped nobody would look. People looked. The headline case is MIFARE Classic, whose Crypto1 cipher was reverse-engineered and broken in 2008. Legacy iCLASS went the same way around 2010. Once an attack is published, it ends up in off-the-shelf tools, and "proprietary" stops meaning "private".
#3. Its keys were never changed
Modern cards like DESFire use real, unbroken crypto (AES). They still fail if deployed carelessly: left on the factory default keys, or using one key across every card. Pull that one key out of a single card or reader and the whole site is open. Good deployments use diversified keys — each card's key derived from a master plus its UID — so cracking one card tells you nothing about the next.
#What to use instead
Roughly in order of effort:
| If you have… | Move toward… |
|---|---|
| 125 kHz Prox, UID-only, EM410x | a modern secure card |
| MIFARE Classic, legacy iCLASS | DESFire EV2/EV3, iCLASS SE / Seos |
| DESFire on default/shared keys | the same card with diversified keys |
| any of the above, on Wiegand | add OSDP with Secure Channel |
The frontier is cards that don't share a secret at all, like MIFARE DUOX and public-key credentials. But most real-world risk is retired just by getting off a fixed number and onto a card whose crypto nobody broke a decade ago.