Fob entry, and an uncomfortable fact about the fob already in your pocket.
Fobs are the default credential in New York buildings for good reasons. But most of the ones in circulation use a technology that a $30 handheld device copies in about fifteen seconds, and nobody tells the board that.
125 kHz proximity is a photocopier with a keyring
It is not that prox has a weakness. It is that prox has no security design at all. It was never meant to have one.
The rounded black fob on most New York keyrings is a 125 kHz proximity credential. When it comes near a reader it transmits a fixed facility code and card number in the clear. There is no encryption, no mutual authentication, and no way for the reader to tell an original from a copy. That was an acceptable design in 1995 and it is not one now.
The numbers are worse than most boards expect. A basic handheld duplicator costs under thirty dollars and clones a fob in roughly fifteen seconds: about five to read it, the rest to write the copy. Long-range harvesting devices that fit in a backpack cost a few hundred and can read a credential through a coat pocket or a handbag from several feet away, in a lobby, on a subway platform, standing behind somebody in a coffee line. Retail kiosks in supermarket chains now duplicate 125 kHz fobs for consumers as a convenience service. Your ex-tenant does not need to keep the fob. They need thirty seconds with it before they hand it back.
The practical consequence is that a prox-based building has an access list that describes intent rather than reality. You can revoke a credential number, and the copy carrying that same number stops working too. That part is fine. What you cannot do is know how many copies exist, or stop someone cloning a current resident’s fob at the mailboxes.
What each credential technology actually gives you
| Credential | How it protects itself | Our position |
|---|---|---|
| 125 kHz proximity (ProxCard-type, Indala, AWID, EM4100) | Nothing. Fixed number sent in plaintext. | Fine to keep running while you migrate. Not something we will install new without telling you in writing what it is. |
| MIFARE Classic (13.56 MHz) | Crypto1, publicly broken. Key-recovery attacks are well documented and tooled. | Not an upgrade. This is the trap in “we moved to 13.56 megahertz”: the frequency is not the security. |
| Original iCLASS (13.56 MHz) | Proprietary cryptography, publicly compromised in 2010. | Same story. Legacy, still widely deployed, not a target state. |
| iCLASS SE and Seos | AES-128 with mutual authentication. | Solid modern credentials. Seos is credential-format independent, which helps if you later add phones. |
| MIFARE DESFire EV3 | AES-128 with mutual authentication, Common Criteria EAL5+ certification. | The strongest mainstream card or fob credential, and what we specify by default on new work. |
| Mobile NFC or BLE | Cryptographic credential held in the phone’s secure element or app. | Good, with caveats. See mobile and cloud access control for the cost model and the outage questions. |
| Keypad code | A shared secret that spreads. | Useful as a backup or for a delivery vestibule. Not a per-person credential, because it never stays per-person. |
One honest caveat that most sales material skips: many encrypted credentials in the field are still running the manufacturer’s factory default keys because nobody changed them at commissioning. An encrypted card on default keys is a lock with the original builder’s key still cut. We change them and we record that we did.
You do not have to re-badge the whole building in one weekend
The reason buildings stay on prox is not that boards like prox. It is that swapping credentials in a 90-unit building sounds like a logistics nightmare, so it gets deferred for another year, and another. The way out is a multi-technology reader.
A multi-technology reader reads both the old 125 kHz credentials and encrypted 13.56 MHz ones at the same time. We change the readers first (a per-door job, no disruption to residents, no re-badging), and the building carries on working exactly as before. Then encrypted credentials get issued at whatever pace the managing agent can actually sustain: at lease renewal, at a couple of scheduled distribution evenings, at the desk. When the number of prox credentials still in use has fallen to a residual handful, we disable the 125 kHz side of the readers in software and hand out the last replacements. From that day the copies do not work.
Two practical notes from doing this. First, a re-badge is the only realistic moment to fix your access list, because it forces every unit to come and identify itself, and buildings routinely find that a sizable share of the active credentials in the system belong to nobody who currently lives there. Second, decide the fob policy before distribution, not during: how many credentials per unit are included, what a replacement costs, who signs for them, and whether contractors and dog walkers get their own credential or a scheduled one. A building that hands out unlimited unrecorded fobs has bought an audit trail it cannot use.
A fob reader is not an intercom, and in many buildings the law is specific about that
We get asked regularly whether a fob system can replace a failing intercom. For residents, it can. For visitors, it cannot, and in a large part of the New York housing stock that distinction is statutory.
New York Multiple Dwelling Law §50-a requires an intercommunication system in Class A multiple dwellings erected or converted after 1 January 1968 containing eight or more apartments. What it requires is specific: two-way voice communication between the apartment and a visitor at the main entrance, and the ability for the resident to release the locking mechanism of that door from the apartment. It is tied to an automatic self-locking door giving public access to the entrance hall or lobby. The self-locking door and the intercom are one legal package. A fob reader on the same door provides neither the voice path nor the remote release, so installing one does not discharge the obligation.
Separately, NYC Admin Code §27-2041.1 and §28-315.10 require self-closing doors in residential buildings with three or more units. In practice the sensible design is both: fobs for residents, and a working entry intercom for everyone else. We build them as one system with one door release rather than two systems fighting over the same strike. See apartment building intercom systems.
The half of a fob system that is not hardware
Fob systems very rarely fail on electronics. They fail on the register, the turnover process and the person who was supposed to own the list.
- Somebody has to own the list. Name that person in the handover document. If credential management is nobody’s job it becomes the super’s job, and the super has forty other jobs.
- Turnover is the whole game. A move-out that does not trigger a revocation leaves a working credential in the world indefinitely. The revocation should be a line on the move-out checklist, next to the keys and the meter reading.
- Log the serial, not just the count. “Apartment 4C has three fobs” is useless. “4C holds 0018842, 0018843, 0021109” lets you revoke exactly one when a roommate leaves badly.
- Set a replacement fee and a cap before distribution. Two included per unit with a charged replacement is the common arrangement, and the charge exists to make people report losses rather than quietly get a copy made.
- Give contractors scheduled credentials. A cleaner who needs Tuesday and Friday mornings should have Tuesday and Friday mornings, not permanent access, and that costs nothing extra on any competent controller.
- Put a door position switch on the entrance. Without one you cannot generate a door-held-open alarm, which means the single most common real-world bypass, the front door propped with a brick during a move, is invisible to a system you paid for.
- Keep the credential numbers when you change contractors. If your fobs can only be ordered from the company that installed the system, that is a business decision made about you, not a technical constraint.
What fob work typically costs
| Scope | Typical installed range | Notes |
|---|---|---|
| One fob-controlled entrance door on an existing lock: reader, controller, fail-secure strike, power and battery | $1,200 to $2,200 | Assumes a workable cable route to a closet. Storefront and fire-rated doors cost more. |
| Adding a rear or service door to a controller with a spare port | $700 to $1,400 | Mostly cable and labor. |
| Reader swap only, keeping existing panels, on an open platform | $350 to $700 per door | The multi-technology migration step. No disruption to residents. |
| 60-unit building: multi-technology readers on three doors, encrypted credentials, two per unit, list rebuilt | $6,000 to $11,000 | Includes the distribution evenings and the credential register, which is the part that actually takes the time. |
| Encrypted credential versus a prox fob, per credential | Single-digit dollars more each | On a 60-unit building at two per unit that difference is a few hundred dollars against a system where every credential is copyable. |
Typical ranges in our service area, subject to survey. Hardware, cable, power, commissioning and documentation are included; any cloud subscription and any line-voltage work by a licensed electrician are not.
Common questions
A resident moved out and kept their fob. What actually happens now?
On a networked system, you or we revoke that credential number and it stops working at every door within seconds. That is the entire point of credentials over keys: no locks to re-key, no other resident inconvenienced. Keep the credential serial numbers against unit numbers and the job takes under a minute.
The uncomfortable version of this answer applies to buildings still on 125 kHz prox. Revoking the number kills the original and any straight copies of it, because a clone carries the same number. What it cannot address is a departing tenant who cloned a neighbor’s fob rather than their own, or who used a long-range reader in the lobby. That is not a scare story, it is why the encrypted migration exists, and it is the honest reason we push it.
Can we keep our existing fobs with a new system?
Usually yes, at least during the transition, and that is often the right sequencing. Multi-technology readers will accept your current 125 kHz credentials alongside encrypted ones, so the new controller and the new software go in without touching a single resident’s keyring on day one.
The exception is a proprietary credential format tied to one manufacturer, where the numbering scheme is licensed rather than open. In those cases the existing fobs cannot be enrolled on anything else, and that is by design. Before we quote, we read a sample fob and tell you which situation you are in. It takes about a minute at the door and it changes the price of the project meaningfully.
How many fobs should each apartment get?
Two included per unit is the arrangement that causes the fewest arguments, with additional credentials available at a stated charge. The charge is not a revenue line. It exists so that losing a fob is a small, reportable inconvenience rather than something a resident hides by getting a duplicate cut at a kiosk.
Set the policy before distribution, put it in the notice that goes under every door, and make somebody the owner of the register. The failure pattern we see repeatedly is a building that distributes generously and records nothing, and then discovers three years later that it has issued 240 credentials into 90 apartments and cannot account for a third of them.
Is a keypad code cheaper than fobs?
The hardware is, marginally. The system is not, because a code is a shared secret and shared secrets travel. Within a year the delivery drivers know it, the previous tenant knows it, and the code is written on the inside of the vestibule door in pencil.
Where keypads earn their place is as a secondary credential on a specific door: a delivery vestibule with a code that rotates, a back door where a contractor needs Tuesday morning access, or a keypad-and-fob combination on a high-value room where you want two factors. As the primary building credential a keypad gives you no audit trail worth the name, because every event says the same thing: somebody who knows the code came in.
Someone told me our fobs can be copied at a supermarket kiosk. Is that true?
For 125 kHz proximity credentials, yes. Consumer key-duplication kiosks in grocery chains have offered RFID fob copying for several years, and handheld duplicators are sold openly online for the price of a takeout dinner. This is not a hack in any meaningful sense. The credential is broadcasting a fixed number and the duplicator simply writes that number to a blank.
For encrypted 13.56 MHz credentials with AES-128 and mutual authentication, no. The reader and the card challenge each other, and a device that captures the exchange cannot reproduce it without the key. That is the actual difference you are buying, and it costs single-digit dollars per credential. It is the cheapest security improvement available to most New York buildings, and it is the one we lead with.
Do we still need the intercom if we install fobs?
Yes, in almost every residential building, and in many of them it is not optional. Fobs solve residents. They do nothing for the visitor, the food delivery, the contractor, the grandmother without a smartphone, or the parcel courier, and a building whose only answer to a visitor is “text the resident to come down” ends up with a propped front door, which defeats the fob system you just paid for.
In Class A multiple dwellings erected or converted after 1 January 1968 with eight or more apartments, Multiple Dwelling Law §50-a requires two-way voice and a remote door release from the apartment. Beyond the legal point, the practical design is a single entrance door with one strike, one power supply, and both the intercom release and the fob reader feeding it, ideally with the intercom release logged as an input so one event history covers the whole door.
Work that usually comes with this
Access Control Installation
Complete door-control systems, from a single door to a multi-building portfolio.
Mobile & Cloud Access Control
Phone-as-credential systems with browser-based administration and remote unlock.
Apartment Building Intercom Systems
Multi-tenant systems for 6 to 200+ units, and what MDL ยง50-a requires of them.
Elevator Access Control
Floor restriction for co-ops, condos and mixed-use buildings.
Co-ops & Condos
Board-vote timelines, shareholder communication, and phased work that doesn't blow the reserve fund.
Apartment Buildings
Walk-ups and elevator buildings, 6 units to 200+, and the law that governs their entry systems.
Bring us one of your fobs.
We can read it at the door and tell you in a minute which technology your building is running, whether it can be cloned, and what a migration would actually involve.
Sun to Thu 9am to 5pm · Fri 9am to 12pm · Sat closed