# Business Security ID/Key card thoughts **URL:** \ **Category:** In My Humble Opinion\ **Created:** [January 25, 2024, 10:14pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638 "2024-01-25T22:14:32Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [January 25, 2024, 11:49pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/21 "2024-01-25T23:49:29Z")
> [@Stranger\_On\_A\_Train](#): > > Sometimes you just need to do a good [pen test](https://youtu.be/GN0XzH268z8?si=0tVZVEosG4DQHAtp) to get the point across. > > Stranger Yup. A hard hat, a clip board and some sort of security badge and story, will get you past a lot of security. > [@Chronos](#): > > The problem can be mitigated by putting time controls on the badges, too. It’d be very easy to set up a system like this so that the badge-holders can get in… but only during their normal hours Many of us need 24/7. IS, Facilities Maintenance, and even my wife that works pretty much when ever she needs to. It’s not that simple, really. > [@Mama\_Zappa](#): > > - person loses badge > - Finder picks it up and does not immediately toss it > - Finder has some reason to want to get into your employer’s office. From a security perspective, this is like leaving a sticky note under your keyboard with your password. Nobody cares, until somebody does. If the employer name was not on the card (like a simple brass key). It would be useless, and not an issue. From an IS/IT perspective this bugs me. ---
**Author:** ![Stranger\_On\_A\_Train](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Stranger\_On\_A\_Train](https://boards.straightdope.com/u/Stranger_On_A_Train)\ **Post date:** [January 26, 2024, 12:00am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/22 "2024-01-26T00:00:22Z")
> [@enipla](#): > > any of us need 24/7. IS, Facilities Maintenance, and even my wife that works pretty much when ever she needs to. It’s not that simple, really. Yeah, time restrictions are generally a terrible idea because the people imposing them often have no idea of what actual work schedules or access needs are. A subcontractor facility I worked at imposed time restrictions that were basically normal office hours, not understanding that employees often have to come in early or late for secure calls hosted in different time zones, or meetings that go long, or just people ‘burning the midnight oil’ to meet critical time lines. Which, surprise, resulted in people chocking doors open or using other means to ensure after hours access, which actually makes the facility less secure. It is like requiring 32 digit passwords, or an easily hacked 2FA verification app on your personal smartphone, or any of a multitude that making complying with security requirements so difficult that employees come up with workarounds that completely compromise security. Stranger ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [January 26, 2024, 12:09am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/23 "2024-01-26T00:09:44Z")
> [@peccavi](#): > > I also recall a few buildings with mixed secure and open areas that had mantraps. With a mantrap, even if you were on the door, the card only got you into the mantrap. In order to get into the building, a guard had to look at you on camera and your information from the computer and determine a match before buzzing you out of the mantrap. Well, we are certainly not that secure. But back when I worked in the office, I was the only guy with two other women. I’m a pretty big guy. It was hinted, that for security, I should be there when he (boss) was gone. Ummm. The women said that if something happened (some weirdo came to do harm) they would run. I guess I was supposed to protect them. We are HARDLY in a dangerous area. Not at all. I could be there by myself of course. Gosh. Thanks. One of the women was a Rugby player in college (22 years younger than I). I want her to have MY back. But I’ve hi-jacked my own thread. ---
**Author:** ![crowmanyclouds](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crowmanyclouds/32/19884_2.png) [@crowmanyclouds](https://boards.straightdope.com/u/crowmanyclouds)\ **Post date:** [January 26, 2024, 12:19am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/24 "2024-01-26T00:19:27Z")
> [@Dewey\_Finn](#): > > Dress up like a member of the cleaning crew or the person who delivers bottled water or some other outsider who’s regularly there, and you can probably anywhere in the building. Elevator maintenance and/or the internet provider for where you’re trying to get in . . . you own the building. ---
**Author:** ![jnglmassiv](https://avatars.discourse-cdn.com/v4/letter/j/f07891/32.png) [@jnglmassiv](https://boards.straightdope.com/u/jnglmassiv)\ **Post date:** [January 26, 2024, 1:11am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/25 "2024-01-26T01:11:02Z")
> [@peccavi](#): > > I do see the disadvantage of a QR code. You don’t really need the card itself; you can use a high-resolution image. The second aspect is reproducing the entry credential. A QR code is easily printed by any number of devices. The RF id data _can_ be spoofed but it’s a lot harder than printing a sticker. ---
**Author:** ![Mean\_Mr.Mustard](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mean_mr.mustard/32/3865_2.png) [@Mean\_Mr.Mustard](https://boards.straightdope.com/u/Mean_Mr.Mustard)\ **Post date:** [January 26, 2024, 1:26am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/26 "2024-01-26T01:26:44Z")
The building I used to work in was closed and locked after hours and on Sundays. Due to the nature of my job, I occasionally had to come in on a Sunday, using a badge swipe to gain access. I was always the only soul in the entire building at those times. More often than not, the building was not even locked. I simply walked in the door. The building is located in a large urban area, not in the best of neighborhoods. Fun times. mmm ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [January 26, 2024, 2:01am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/27 "2024-01-26T02:01:37Z")
> [@enipla](#): > > From a security perspective, this is like leaving a sticky note under your keyboard with your password. Nobody cares, until somebody does. > > If the employer name was not on the card (like a simple brass key). It would be useless, and not an issue. Right - but if someone grabs that sticky note, they’re in the population of people that is targeting you, or at least employees of your agency. If you drop that sticky note (or your badge) on the sidewalk a block away from the office, chances are whomever picks it up has no interest in sneaking into your building. I doubt the average random person is going to say “well lookee here. Maybe I’ll go in and steal a computer or blow some shit up.”. Sure, it might happen, but very few people would go that route (unless, as noted,t hey were targeting your agency already, in which case it’s not random). I just think the odds of a dropped key card falling into the hands of someone who’s likely to do mischief are not terribly high. If you WERE being targeted, that brass key would be plenty useful. Personally, if I found such a card, I’d likely either a) ignore it, b) make a point to try to contact the agency or the holder and get it back to them, or c) toss it in my purse, meaning to do so, then discover it 6 months later buried under other purse contents. The QR code approach does strike me as less secure - too easily duplicated, even if someone wants to make up a fake card with photo ID, which would satisfy the “gotta wear a badge” requirement. If the entrance is staffed by a security guard, that’s an additional layer of protection - those guys aren’t going to catch EVERYONE, but they might recognize that “you” aren’t really “you” as the card thief sails by. All in all, it isn’t a new problem, nor one that overly concerns me. Having your office address seems unnecessary, I’ll admit - I think a simple “Enipla, Such-and-such County” would be sufficient (my own just say my name and the agency). Note: I’m also IT, and have a security certification, so I’m not at all unaware of the concerns. ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [January 26, 2024, 2:44am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/28 "2024-01-26T02:44:54Z")
> [@Mama\_Zappa](#): > > > [@enipla](#): > > > > From a security perspective, this is like leaving a sticky note under your keyboard with your password. Nobody cares, until somebody does. > > > > If the employer name was not on the card (like a simple brass key). It would be useless, and not an issue. > > Right - but if someone grabs that sticky note, they’re in the population of people that is targeting you, or at least employees of your agency. If you drop that sticky note (or your badge) on the sidewalk a block away from the office, chances are whomever picks it up has no interest in sneaking into your building. I doubt the average random person is going to say “well lookee here. Maybe I’ll go in and steal a computer or blow some shit up.”. Sure, it might happen, but very few people would go that route (unless, as noted,t hey were targeting your agency already, in which case it’s not random). I just think the odds of a dropped key card falling into the hands of someone who’s likely to do mischief are not terribly high. If you WERE being targeted, that brass key would be plenty useful. > > Personally, if I found such a card, I’d likely either a) ignore it, b) make a point to try to contact the agency or the holder and get it back to them, or c) toss it in my purse, meaning to do so, then discover it 6 months later buried under other purse contents. My cousin is a lawyer; first job out of law school was as an ADA; eventually quit there to go into private practice & make real money but was allowed to keep his badge when he left. He gets a call one day from the PD; they’ve found his badge/wallet in a drug den in the 'hood. Seems he went to work one day & hung his suit coat on the back of his office door, with his wallet in the interior pocket. While he was in _the_ office but not _his_ office someone got in & found his wallet & immediately used the cash/cards to score their next hit. Don’t make it too easy for someone to steal stuff. If you lose it & I\* find it & I know that’s a access card for a place only a block away I know that the key for me to get some goodies (phones, laptops, etc.) I’ve had badges that say, “If found, return to PO Box \_\_\_, City, State, Zip. No postage required.” One couldn’t do anything with that badge as you don’t know what building it gets you into. . -\* Well, not me personally, I wouldn’t do that, but you get my point. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [January 26, 2024, 2:55am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/29 "2024-01-26T02:55:58Z")
> [@Spiderman](#): > > While he was in _the_ office but not _his_ office someone got in & found his wallet & immediately used the cash/cards to score their next hit. > Don’t make it too easy for someone to steal stuff. If you lose it & I\* find it & I know that’s a access card for a place only a block away I know that the key for me to get some goodies (phones, laptops, etc.) Yes - but again, most people won’t do that sort of thing. And yeah, you need to take reasonable precautions with wallets etc. anywhere. Years back, I was on a project which had an admin assistant. One day, she was out (sick or something) and a temp was brought in for the day. She went out for lunch - and never came back. Most / all of the project had been upstairs at a meeting - and she went through several wallets, stole credit cards, and went shopping that afternoon. I found about it when the project manager called me at home that night, and asked me to check my wallet as several colleagues had their cards used (mine was not stolen). It was clearly a crime of opportunity in that place. I would bet your cousin’s badge had not been used to access his former employer, right? Just the money/cards? ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [January 26, 2024, 3:18am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/30 "2024-01-26T03:18:14Z")
ISTM/IME, any entity that is at least semi-serious about cardkey security has plain blank cards with no info beyond face, name, and maybe barcode/QR code, but better an RFID chip. Which sounds good until your employer is the biggest most obvious in town or you lose your badge on the outskirts of their perimeter. Anyone who is serious about security does not grant access to badges. They grant access to badges accompanied by fingerprints, PINs, faces, passwords, etc. The badge is necessary, but much short of sufficient. And those other things are chosen to be hard to spoof. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [January 26, 2024, 5:26am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/31 "2024-01-26T05:26:03Z")
To check for an RFID or NFC chip in the card, install an NFC reader on your phone. On Android I can recommend [NFC Tools](https://play.google.com/store/apps/details?id=com.wakdev.wdnfc), and I’m sure there are ones for iPhone. Then just put the card to the back of your phone. It might identify a MIFARE or something, or nothing at all. A proper RFID or NFC chip can have a cryptographic challenge, so in theory the card can’t be cloned. I think the only thing that makes a QR code less secure than a magnetic strip is the QR code can be copied while the card sits in your car by a device everyone carries. The magnetic strip at least requires spending $20 on a writer. Oh yeah, Summit, Clear Creek, Eagle, Lake, Park? Asking for a friend. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [January 26, 2024, 9:19am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/32 "2024-01-26T09:19:51Z")
I just looked at one of my badges. It has my name, a serial number, photo, and the agency I work for. Which doesn’t narrow it down much. as that agency has many, many locations (but to the best of my knowledge, the card would get me into almost any of them - though by showing it to a guard, versus scanning it). I also use that card to log into my client computer - and for that, I do need a PIN. My other badge is put away. IIRC, it has similar information. When I go to that client’s site, I scan it on a reader at the main entrance. So almost anyone COULD get in using it. I would probably need to use a PIN if I used it to access a government-owned computer. In neither case do I need to provide anything other than the card , to physically access the building. ---
**Author:** ![Cervaise](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cervaise/32/16693_2.png) [@Cervaise](https://boards.straightdope.com/u/Cervaise)\ **Post date:** [January 26, 2024, 9:38am UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/33 "2024-01-26T09:38:23Z")
I work at a fintech firm providing software and services to large financial institutions which have rigorous security rules and pass those rules onto their vendors. My office access card is blank white on both sides, just a small serial number, for exactly the reasons described in the OP. It’s also why many hotels — not all, but many — don’t put identifying information on their guest keycards. When these were first introduced, they were yet another opportunity to emphasize the brand, but then hotel security experts realized a lost card was basically labeled “use me here!” If the guest reported the loss, it would be canceled, and even if not reported (e.g. it was a second card) it would still be deactivated on checkout, but there was still a window in which someone could bring the card, use it in the elevator, and then prowl around. So now many hotels (again, not all) issue keycards with pleasant but generic decoration, like those “enjoy your pizza!” boxes used by restaurants that can’t afford their own branded material. If someone finds a lost card and it’s still active, they don’t know where to use it. The card can’t be returned, but there’s no security risk. Boggles the mind that a professional corporation doesn’t understand this. ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [January 26, 2024, 12:36pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/34 "2024-01-26T12:36:21Z")
> [@Cervaise](#): > > My office access card is blank white on both sides, just a small serial number, for exactly the reasons described in the OP. That’s what my card used to be. So it did have a chip in it. I understand that very few would find the card and want to do mischief. But, we are county government, as such we are the ‘tax man’. Home valuations went up 100% last year. Thus, raising taxes. People where pissed. Just so happens that my card also gets me into the Assessors office. Not sure yet, but I think all the server rooms too. Information Systems departments need pretty wide access. And often have to work after hours. It’s kinda weird. Why do we need a picture ID? Our buildings are open to the public. We have no security guards. And no policy about someone that does not have an ID. At least yet. I totally get that cards are more secure than a key. A fired employee that ‘lost’ his key can be a dangerous thing. ---
**Author:** ![Jasmine](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jasmine/32/2964_2.png) [@Jasmine](https://boards.straightdope.com/u/Jasmine)\ **Post date:** [January 26, 2024, 12:54pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/35 "2024-01-26T12:54:34Z")
That’s telling him! 😆 ---
**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\ **Post date:** [January 26, 2024, 2:20pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/36 "2024-01-26T14:20:58Z")
In my experience the keycards issued to hotel guests may say Hilton or whatever but don’t list the specific hotel nor do they include the room number. ---
**Author:** ![hajario](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hajario/32/171_2.png) [@hajario](https://boards.straightdope.com/u/hajario)\ **Post date:** [January 26, 2024, 2:23pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/37 "2024-01-26T14:23:11Z")
I haven’t seen a hotel key with a room number in decades. Like not since they were actual metal keys. ---
**Author:** ![Cervaise](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cervaise/32/16693_2.png) [@Cervaise](https://boards.straightdope.com/u/Cervaise)\ **Post date:** [January 26, 2024, 2:46pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/38 "2024-01-26T14:46:45Z")
Knowing the specific room is useful, yes, but just knowing the hotel means you can use it in the elevator to get past the lobby and wander around unsupervised. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 26, 2024, 3:06pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/39 "2024-01-26T15:06:06Z")
There’s something about QR codes that seems to trick people into thinking they are some kind of magic. Just because they’re not human readable. I think - non-technical people sometimes regard them as being like encryption or otherwise being somehow secure. ---
**Author:** ![minor7flat5](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/minor7flat5/32/258_2.png) [@minor7flat5](https://boards.straightdope.com/u/minor7flat5)\ **Post date:** [January 26, 2024, 3:16pm UTC](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638/40 "2024-01-26T15:16:50Z")
> [@peccavi](#): > > Yeah, this is unrealistic. At my company, we have the equivalent of the DoD [CAC](https://en.wikipedia.org/wiki/Common_Access_Card) Wow, that is an amazing upgrade to the military ID card. The ones we had in my own time (1980s) were comically primitive as far as security features went. They were fancy printed documents that were hand-typed, a photograph laid on, and then laminated. It was quite common for guys to cut a typewritten digit from their pay statement and lay it over the last digit of their birth year, then laminate over the top, so they could appear to be of drinking age. The bosses knew this trick and would occasionally inspect our ID cards, feeling for extra thickness and tilting the card in the light to see if there was a telltale bump on the birth year. [Previous page](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638.md?page=1) [Next page](https://boards.straightdope.com/t/business-security-id-key-card-thoughts/996638.md?page=3)