4 ms·

For a while I've had a question about hotel keycard technology, maybe you can answer. Essentially every time I've stayed in a hotel with contactless keycards (

For a while I've had a question about hotel keycard technology, maybe you can answer. Essentially every time I've stayed in a hotel with contactless keycards (usually in a group needing 3-5 rooms for 2-3 nights) at least one person has needed to get a keycard reissued. What's up with that? My workplace's smartcards and my contactless bank cards keep working for years on end.

lxgr 3y ago
Hotel keycards usually work by having dynamic data written to them at the front desk (as the locks are often not network connected, at least in older systems, so they write things to the card like "works for room 123 until March 30th noon and the gym" or "works for room 456; sequence number 2, invalidate all prior keys"). There are two types of magnetic stripe cards available: High-coercivity (HiCo) and low-coercivity (LoCo). The field-rewritable kind used in hotels is usually LoCo, to make the writers smaller and cheaper. But that also makes the cards much more prone to accidental corruption by magnets you might have on you, like earbuds, magnetic wallets etc. Bank cards are usually only ever programmed once (these days), i.e. when they're issued, so they're usually HiCo, making them much more robust against that. In addition to that, magnetic stripe usage has been phased out for payment cards in most countries and is getting rare even in the US, so for all you know, and depending on where you live/shop, your magnetic stripes might have already been demagnetized without any adverse effects! Bonus trivia question: Guess which kind NYC MTA Metrocards are :) Edit: Oh, I just saw that you asked about contactless keycards! For these I actually have no idea, and I haven't had one fail on me yet. I just know that they often use a similar scheme ("works for rooms x, y, z, until timestamp n"), sometimes with a bit of cryptography on top (often with a single shared key across all instances of the same lock and even across hotels...) but using non-networked locks, so there can definitely be synchronization/propagation issues too.
- neuralRiot 3y ago
  I used to work as maintenance on a big chain hotel and we had magstripe card locks, I don’t think strong security is their primary goal as in a hotel the staff can enter any room at any time, the cards me and my team had were “god mode” we could open any door at any time even when locked from inside. If the lock didn’t work “firmware problems, dead batteries, stuck mechanism” we had another device that worked by removing a cover and connecting with a wire, this was also used for testing and FW updates.
  - lotsofpulp 3y ago
    > the cards me and my team had were “god mode” we could open any door at any time even when locked from inside. That is just bad management. The whole point of the interior deadbolt lock in a hotel room door is so no one can accidentally walk in on you thinking it is an empty room. An emergency keycard that can open a hotel room locked from the inside is only supposed to be kept at the front desk for use during an emergency, mostly by police or firefighters so they do not break down the door and cause tens of thousands of dollars of damage. And its presence and use should be constantly accounted for.
    - throwaway2037 3y ago
      > cause tens of thousands of dollars of damage This is surely overstated. I am sure firefighters are trained to do the least amount of damage when forcing a hotel door open. I guess a handheld electric saw could do the trick in less than one minute.
      - rubidium 3y ago
        Um, no they’re trained to get in as fast as possible. Life >> cost of any door.
      - deleted 3y ago
        [deleted]
      - lotsofpulp 3y ago
        Any non ancient hotel will have metal fire doors that cost near a thousand themselves, plus the metal framing and whatnot. The cops or firefighters are not going to spend time cutting, they are going to bust it open with a battering ram which will ruin everything, requiring reframing, new door, new thresholds, new frames, new locks ($2k), and maybe flooring too. And then add in opportunity cost from not being able to rent the room during repair, which would take weeks due to those materials not being available at Home Depot. I would budget at least $10k, and I bet it would not exceed $20k, but either way, using a battering ram on a hotel door is very costly.
      - 3y ago
- Detrytus 3y ago
  Shouldn't that be other way around? Keycard only holding the simple numeric id, which is burned into silicone chip on it and impossible to modify, and the reader at the door, connected to hotel central system checks what privileges that particular keycard grants?
  - tesseract 3y ago
    In the days before cheap, low-power radio networks a "central system" would have meant dedicated wiring to each door lock. So it would have been much more expensive to install than a standalone battery powered unit mounted directly on the door.
  - maxerickson 3y ago
    You could force or deny service on a lock that just checked a simple ID.
    - justinclift 3y ago
      Wouldn't that only be for poor implementations? If the reader had a decently secure channel to the central auth piece, then it shouldn't (in theory) matter how simple or complex the id would be. (?)
  - andreareina 3y ago
    That doesn't stop someone else from flashing a reprogrammable keycard with the id.
  - lxgr 3y ago
    > the reader at the door, connected to hotel central system That’s very often not the case, though, especially in retrofitted installations. Locks are sometimes offline and even battery powered (and I suspect they can even report a dying battery to the front desk by setting the appropriate flag on keycards as they’re being read).
- mushufasa 3y ago
  > Guess which kind NYC MTA Metrocards are :) None anymore! They're being phased out as we speak. They were supposed to be end of life last year, though they pushed back end of life EoY 2024, because the MTA is never on time, all the time.
  - lxgr 3y ago
    And I’ll be swiping until the day they remove the readers if they don’t introduce monthly capping via OMNY! The Metrocard is actually a quite elegant and resilient/decentralized system, given the technology that was available when it was introduced. OMNY depends on a network connection being (almost) always available.
    - drchickensalad 3y ago
      OMNY has had automatic fare cap for 2 years?
      - lxgr 3y ago
        Not monthly, though. If you take the subway every day, a monthly Metrocard is cheaper.
- julian_t 3y ago
  At least with old fashioned keys you can't easily give out a duplicate. I was once in bed, late at night, lights out, when someone let themselves into my room - a rather drunk guy demanding to know what I was doing in his room. The desk clerk had got his room number wrong and given him another card to mine. It all worked out OK, but under other circumstances I could imagine that it might not.
vizzah 3y ago
I had the same experience with NFC hotel card failing after being in my pocket (next to other cards and a phone). It had to be re-programmed at the hotel's desk to work again. Puzzled me enough to search net for the answers, but to no avail.
- tonyarkles 3y ago
  It's the phone. Have had this happen multiple times with just the card and my phone. Not sure if it's doing some kind of NFC ping on the phone or if there's just enough of a magnetic field around it or what, but I reliably locked myself out of my room the first week doing field work this year by putting my phone and my hotel card in the same pocket.
lotsofpulp 3y ago
> What's up with that? It was programmed incorrectly and expired before it should have. The stay was extended but the key was not updated with the new departure date. A new key was erroneously issued for the room, someone used the new key to go into the room, saw someone was already staying in the room, and had to get keys for a different room. This would cause all old keys to stop working since every time a lock sees a new key used, it assumes a new hotel guest is staying. Or it lost its data for whatever reason.
- hunter2_ 3y ago
  My brain was ANDing the first three paragraphs until I got to the OR in the last paragraph, wondering why in the world those otherwise discrete scenarios would have a combinatorial effect. I'm wired to look ahead to determine AND versus OR with a comma-delimited series, but not with a paragraph-delimited series. It's a cool pattern but very unexpected, and I'm not sure you could successfully tack on other thoughts before or after the series, because what would delimit those from the series without overloading the meaning of a paragraph separation? Given a need for multi-sentence items within a series, I go for bullet points. Hyphen character to start each point if no rich UL formatting is available.
- hypercube33 3y ago
  there you go. make a fake coil card and tell the door you're staying for 25 years and a new guest ...get in and own the room
  - Moru 3y ago
    Until the next guest arrives, card saying they are staying until next monday and clear all previous keys.

lxgr 3y ago

Hotel keycards usually work by having dynamic data written to them at the front desk (as the locks are often not network connected, at least in older systems, so they write things to the card like "works for room 123 until March 30th noon and the gym" or "works for room 456; sequence number 2, invalidate all prior keys"). There are two types of magnetic stripe cards available: High-coercivity (HiCo) and low-coercivity (LoCo). The field-rewritable kind used in hotels is usually LoCo, to make the writers smaller and cheaper. But that also makes the cards much more prone to accidental corruption by magnets you might have on you, like earbuds, magnetic wallets etc. Bank cards are usually only ever programmed once (these days), i.e. when they're issued, so they're usually HiCo, making them much more robust against that. In addition to that, magnetic stripe usage has been phased out for payment cards in most countries and is getting rare even in the US, so for all you know, and depending on where you live/shop, your magnetic stripes might have already been demagnetized without any adverse effects! Bonus trivia question: Guess which kind NYC MTA Metrocards are :) Edit: Oh, I just saw that you asked about contactless keycards! For these I actually have no idea, and I haven't had one fail on me yet. I just know that they often use a similar scheme ("works for rooms x, y, z, until timestamp n"), sometimes with a bit of cryptography on top (often with a single shared key across all instances of the same lock and even across hotels...) but using non-networked locks, so there can definitely be synchronization/propagation issues too.

neuralRiot 3y ago
I used to work as maintenance on a big chain hotel and we had magstripe card locks, I don’t think strong security is their primary goal as in a hotel the staff can enter any room at any time, the cards me and my team had were “god mode” we could open any door at any time even when locked from inside. If the lock didn’t work “firmware problems, dead batteries, stuck mechanism” we had another device that worked by removing a cover and connecting with a wire, this was also used for testing and FW updates.
- lotsofpulp 3y ago
  > the cards me and my team had were “god mode” we could open any door at any time even when locked from inside. That is just bad management. The whole point of the interior deadbolt lock in a hotel room door is so no one can accidentally walk in on you thinking it is an empty room. An emergency keycard that can open a hotel room locked from the inside is only supposed to be kept at the front desk for use during an emergency, mostly by police or firefighters so they do not break down the door and cause tens of thousands of dollars of damage. And its presence and use should be constantly accounted for.
  - throwaway2037 3y ago
    > cause tens of thousands of dollars of damage This is surely overstated. I am sure firefighters are trained to do the least amount of damage when forcing a hotel door open. I guess a handheld electric saw could do the trick in less than one minute.
    - rubidium 3y ago
      Um, no they’re trained to get in as fast as possible. Life >> cost of any door.
    - deleted 3y ago
      [deleted]
    - lotsofpulp 3y ago
      Any non ancient hotel will have metal fire doors that cost near a thousand themselves, plus the metal framing and whatnot. The cops or firefighters are not going to spend time cutting, they are going to bust it open with a battering ram which will ruin everything, requiring reframing, new door, new thresholds, new frames, new locks ($2k), and maybe flooring too. And then add in opportunity cost from not being able to rent the room during repair, which would take weeks due to those materials not being available at Home Depot. I would budget at least $10k, and I bet it would not exceed $20k, but either way, using a battering ram on a hotel door is very costly.
    - 3y ago
Detrytus 3y ago
Shouldn't that be other way around? Keycard only holding the simple numeric id, which is burned into silicone chip on it and impossible to modify, and the reader at the door, connected to hotel central system checks what privileges that particular keycard grants?
- tesseract 3y ago
  In the days before cheap, low-power radio networks a "central system" would have meant dedicated wiring to each door lock. So it would have been much more expensive to install than a standalone battery powered unit mounted directly on the door.
- maxerickson 3y ago
  You could force or deny service on a lock that just checked a simple ID.
  - justinclift 3y ago
    Wouldn't that only be for poor implementations? If the reader had a decently secure channel to the central auth piece, then it shouldn't (in theory) matter how simple or complex the id would be. (?)
- andreareina 3y ago
  That doesn't stop someone else from flashing a reprogrammable keycard with the id.
- lxgr 3y ago
  > the reader at the door, connected to hotel central system That’s very often not the case, though, especially in retrofitted installations. Locks are sometimes offline and even battery powered (and I suspect they can even report a dying battery to the front desk by setting the appropriate flag on keycards as they’re being read).
mushufasa 3y ago
> Guess which kind NYC MTA Metrocards are :) None anymore! They're being phased out as we speak. They were supposed to be end of life last year, though they pushed back end of life EoY 2024, because the MTA is never on time, all the time.
- lxgr 3y ago
  And I’ll be swiping until the day they remove the readers if they don’t introduce monthly capping via OMNY! The Metrocard is actually a quite elegant and resilient/decentralized system, given the technology that was available when it was introduced. OMNY depends on a network connection being (almost) always available.
  - drchickensalad 3y ago
    OMNY has had automatic fare cap for 2 years?
    - lxgr 3y ago
      Not monthly, though. If you take the subway every day, a monthly Metrocard is cheaper.
julian_t 3y ago
At least with old fashioned keys you can't easily give out a duplicate. I was once in bed, late at night, lights out, when someone let themselves into my room - a rather drunk guy demanding to know what I was doing in his room. The desk clerk had got his room number wrong and given him another card to mine. It all worked out OK, but under other circumstances I could imagine that it might not.

vizzah 3y ago

I had the same experience with NFC hotel card failing after being in my pocket (next to other cards and a phone). It had to be re-programmed at the hotel's desk to work again. Puzzled me enough to search net for the answers, but to no avail.

tonyarkles 3y ago
It's the phone. Have had this happen multiple times with just the card and my phone. Not sure if it's doing some kind of NFC ping on the phone or if there's just enough of a magnetic field around it or what, but I reliably locked myself out of my room the first week doing field work this year by putting my phone and my hotel card in the same pocket.

lotsofpulp 3y ago

> What's up with that? It was programmed incorrectly and expired before it should have. The stay was extended but the key was not updated with the new departure date. A new key was erroneously issued for the room, someone used the new key to go into the room, saw someone was already staying in the room, and had to get keys for a different room. This would cause all old keys to stop working since every time a lock sees a new key used, it assumes a new hotel guest is staying. Or it lost its data for whatever reason.

hunter2_ 3y ago
My brain was ANDing the first three paragraphs until I got to the OR in the last paragraph, wondering why in the world those otherwise discrete scenarios would have a combinatorial effect. I'm wired to look ahead to determine AND versus OR with a comma-delimited series, but not with a paragraph-delimited series. It's a cool pattern but very unexpected, and I'm not sure you could successfully tack on other thoughts before or after the series, because what would delimit those from the series without overloading the meaning of a paragraph separation? Given a need for multi-sentence items within a series, I go for bullet points. Hyphen character to start each point if no rich UL formatting is available.
hypercube33 3y ago
there you go. make a fake coil card and tell the door you're staying for 25 years and a new guest ...get in and own the room
- Moru 3y ago
  Until the next guest arrives, card saying they are staying until next monday and clear all previous keys.