Subscriber Discussion

The Tradesperson Should Have Requisite Knowledge To Design And Install The System In Accordance With The Customer's Requirements. Are They Not "Professionals"?

JP
Jamie Pugh
Oct 30, 2018

We've known about this since reading an article about an intern working at RIM (now known as Blackberry) who built a sniffer well over 10 years ago. We have been transitioning away from 125kHz for several years. Now that the cost differential is negligible on new jobs we only quote smart card format. On existing clients we have notified them and look for opportunities to swap out if they upgrade old systems or do major addons. If you change out the readers to HID multiclass you can support older formats while issuing 13.56 credentials on anything new.

It will happen eventually, maybe slowly but at some point the format will be retired. I remember when Wiegand swipe cards were the standard and how many of those are still being used? A major vertical for us is condos and this is a big problem, especially in Toronto. In addition to losing control over who has access to facilities there have been stories of people renting out the building's guest suites on Air BNB and selling "fitness club memberships" using cloned 125 kHz credentials.

I agree that Bluetooth and NFC are still a bit too flaky for everyday use at present so the best you can do is advise your clients and make recommendations. If they can't/won't take your advice then so be it.

As for blaming ADI for selling insecure products I think that's a bit of a reach. They move boxes to make money. The products are legal and it's up to the person buying the product to understand the product's limitations and to determine if it's appropriate for the application. We rely on our own experience and expertise to be able to do the right thing for the customer. Expecting the distributor to do that is unrealistic, and in my view, unnecessary. ADI sells to the trade (well, mostly the trade) not retail consumers. The tradesperson should have requisite knowledge to design and install the system in accordance with the customer's requirements. Are they not "professionals"?

NOTICE: This comment was moved from an existing discussion: ADI Pushing Cracked 125 Khz Access Control

(1)
(1)
JH
John Honovich
Oct 30, 2018
IPVM

Jamie, I made this its own post because I think it's a very good topic.

1. I agree with you. The tradesperson should have requisite knowledge.

2. In practice, that is often not the case.

An example: I like going to ADI Expos. ADI does a good job putting it together and it is an efficient way to catch up with a lot of manufacturers. I also talk to some dealers and listen in to what they talk about and questions that they ask at the 'Seminars' held as part of it. The average dealer there has lots of fundamental misconceptions and ignorance on the things they sell / install.

Who's to blame for this is a good question. Is it the dealers themselves? Is it the manufacturers? Is it the mega distributors like ADI for ignoring it? Is it the government for not more heavily regulating it? Is it the media like IPVM for not calling it out enough?

Avatar
Daniel S-T
Oct 30, 2018

Personally I think the government should step in at some point and start regulating. Or at least more heavily and consistently.

I like to compare with the electrical trade, even though I know we are not one in the same. Sure, it's not perfect, but they have codes to follow, an apprenticeship program, etc.

I've always felt like this is a system that we could benefit from in our industry, especially as we start touching more and more things. Maybe a four year apprenticeship is excessive, but having something, anything has to be of a benefit right?

School new techs can go to to learn the basics, one single book they can look to and read for relevant codes and best practices.

The industry is still a hodge podge of skill levels. You got your trunk slammer, and your giant multi-national integrator and everything in between. Sometimes you got a "trunk slammer" who really knows his stuff, and a tech who's spent his career at a multi-national integrator that still doesn't know 125kHZ is bad.

(1)
(1)
(1)
Avatar
Brad Wareham
Oct 30, 2018

There is no excuse for selling 125KHz readers.  There are enough alternatives to HID with competitive pricing on hardware / credentials to give you a clean migration path, pricing that won't kill the sale on a competitive bid, while including 13.57 MHz, BTLE and/or NFC and OSDP that are rock solid.

It behooves the industry to NOT sell known unsecured credentials and hardware from any vendor.  I know I won't do it.

I carry my clone tool and blanks on sales calls for that purpose (the best $21 investment I've ever made).  Once this is in the mind of the end user, they would be foolish to not ask the competitors if their quote leaves them vulnerable.

Have I lost projects due to this, absolutely.  Do I sleep better at night knowing I won't comprise on the same, absolutely.

Unfortunately, in the litigious society we live in, this will not be decided by someone buying a 2-Door kit at ADI, it will be a class action lawsuit that pushes all the insurance carriers we relay on to cap E&O or dictate the exclusion of 125KHz readers and credentials.

This should not be a government issue, we are smarter than this, it's the naivety of our business and the ultimate pursuit of a sale.  As an industry, our job is to mitigate risk, not exponentially increase it.

(1)
(1)
JP
Jamie Pugh
Oct 30, 2018

I don't think we need to get the Government involved as this will add cost, complexity and simply drive the shoddy workers into the grey market. Even with building codes and apprenticeship programs there are still an awful lot of unskilled people doing renos, electrical, plumbing, framing, etc for cash and without permits, licenses, insurance, etc.

125 kHz prox credentials are easily duplicated but they aren't a fire hazard or a direct threat to peoples' well being. If we are going to get bent out of shape over this then why are we not worried about people that don't have high security key systems? Your garden variety Schlage keys are easily duplicated for a few bucks at a hardware store or a locksmith. Why isn't every locksmith in the land shouting from the roof tops and why isn't the Govt. doing anything about this?

To be clear I don't sell 125kHz anymore either and I'm in favour of higher security but it makes no sense to try and legislate it or force it on the end users if they don't want it. You can have the highest security credentials on the planet but they are worthless if someone props the door open. (Yes we also do door position monitoring as a standard feature of our access systems but that's not the point)

Those in the business that choose not to stay abreast of new technologies and emerging trends will be left behind, or sued or otherwise relegated to the sidelines. I for one am quite fine with them being my competition. 

(2)
New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions