Multi-technology readers
One reader that speaks Prox, iCLASS, MIFARE and mobile all at once — and hands the controller a plain number, so a cracked card and a modern one come out identical.
A multi-technology reader reads more than one kind of card. Hold up a 125 kHz Prox badge, a 13.56 MHz MIFARE card, an iCLASS credential or a phone, and the same grey box on the wall handles all of them. HID's multiCLASS SE and Signo lines are the ones you'll see most; other vendors make the same thing.
They exist for one very good reason: migration. Swapping every reader in a building is the expensive part, so you swap readers once to something that accepts the old cards and the new ones, then reissue cards at your leisure. Sensible. It also hides a trap.
#On the wire, every card is just a number
A reader's job is to read whatever it can and pass a credential down the cable to the controller. Classically that's a Wiegand frame — a facility code and a card number — and that's all the controller gets. It never learns whether that number arrived on a cloned Prox card or a cryptographically signed Seos credential. If both cards carry the same facility code and card number, they are identical on the wire. Indistinguishable.
#The door is only as strong as its weakest card
Here's the catch in full. Your users carry shiny Seos credentials. The reader, for migration's sake, still accepts legacy Prox. An attacker shows up with a copied Prox card carrying a valid facility code and card number. The reader reads it, emits exactly the Wiegand frame a Seos card would, and the controller opens the door. All that card security you paid for protected the card — and the reader waved the weak one through anyway.
So the strength of a multi-tech door isn't set by your best credential. It's set by the weakest technology the reader still accepts. See why old cards are a bad idea for what "weak" means here.
#Finishing the migration
- Turn off what you don't use. Once cards are reissued, disable Prox and legacy iCLASS acceptance on the readers. This is the step that actually makes the upgrade real, and the one most often skipped.
- Let the wire carry more. OSDP can pass richer data than a bare number — more of the credential, and which technology it came from — so a controller could in principle make policy decisions a Wiegand number can't support. Plenty of deployments still just forward the card number, but the option is there.
- Remember the card can't save you here. Diversified keys and signed SIOs protect the credential from cloning. None of that matters if the reader next to it is still happily reading a 125 kHz badge from 2006.