Worst Readers Ever: Keypads

Author: Brian Rhodes, Published on Sep 16, 2013

One type of access control reader wins the title "Worst Choice" - the common keypad. When used improperly, keypads will let people through locked doors almost as if they were unlocked. Despite significant drawbacks, these devices are still one of the most popular choices in access today. In this note, we examine the weaknesses of keypads, offer advice on how deploy them securely, and examine a type of pad that overcomes glaring weaknesses.

Operation Described

*** ******** ** ******* ** ****** ************* ******. *** **** ** **** ******* ****** ***** *** user ****** * ***** *********** ******, ******* * ******** ** numbers. **** ****** ******* ************ ****** **** **** ***** *** number, ****** ******** ************** ****** (***). ****** *** **** ****** a ***** ***********, *** ******* ******* ******.

Why *******?

** ***** ***** ******* *** ** ********, *** ** ****** use ****? *** ****** ******* '***' ** ***** ************* ** ******** ********** ** ********. ***** *** ** ***** or **** ** ***, ************ ** ******, *** ******** ******* to ******. * **** ** ***** ** ****** **** **** is ********** ********* ** ******** ** ***** *********, *** ******* else ** ********.

*** **** ** ******** ********** ******* ** * ***** ********* cost ******** ** '********** *****' *******.

The ********

******* ***** *** ** *** ****** *** **** **** ****** readers, ******* **** **** ***************. ***** *****, ** ***** ** special ***** ** ****** ** ******* ***** ********. ***** ********** units *** ** ******, ** **** *****, **** ****** ** these ************, *** ******* ******** ***:

  • ********* ******* 
  • ******** ****
  • ******* ** ****

** *** ******** *****, ** ******* ***** ****** *** ******* how **** ********* **** *** **** ****** ******* ******** *** most ****** *****.

********* *******:****** ******* **** *** ******* **** **** ****. **** ** a **** *******, ******* **** *** ******* ****** ** **** access *** *** **** ********* ******* ***** ** ***. **** the *** ******** *****:

*** **** **** *** ******* **** **** ** **** *** grime **** ****'* *******. ** ***** ******, **** **** ******* show **** ****, *** **** *** **** ************* ******** ***** likely ********* *** ******** ******** ** *** ****** **** * common ************** ** *** ****, ***** ******* *******. ****** ******** *** **** **** * ******* ** ********** **** open **** '*******' ****. ****** *******, **** **** ************ * 'random' ******, ****** *** ********* ************ **** **** ** ********* to * *** *******, *** ****** ************ (*******/*****/********* *******) *** take ******* ** ****** ****.

********, **** ** ******* ** *** ******* ** *** *****. However, ******* ** *****, ****** *** ****** ** *********** ** high-grade ********* ***** ** ********. ******* *** ***** ******* ** a **** ***** **** '*******' *******, *** **** ****** *** unused ******* *** **** ***** *** ******* **** ***** ******* are *****. ** **** ****, ******** *** *********** ** ****** instantaneous.

******** ****: **** **** ******** ** ***** ************ ** *** *******, users *** ** ******* ******** ***** *****. ****** * **** is ********** ** ********* ***** ******* *** *** ****** ***** ******** a ***, **** * ****** ******** *** **** *** ******** the ****. * **** ********** ******** *** **** *** **** range ****** ** **** '******' ******* ******* ** ***** *** ***** ************:

******* ** ****:**** ** '*******' ***** ** ******* * **** *** *********, a **** ************* ****** ********** ** ******** *** ***** ******* codes ********. ** *** **** **** ** **** ******** *** an ************ ************, *** ******* * ****** *** **** **** one ***** ****** ***** **** '****** *******' ** ****.

Overcome *** **********

********** ** *** ***************, ******* *** ********* ** ****** ** modern ****** ******* *******. **** ******* ********* *** ****** **********, the ******** **** *** ** *********. *** ***** *******:

***** *** ******** *****:**** **** ****, *****, *** **** '*********' ******* **** ****. Installing******* ****** ** ****** ************* ****, *** ********** ********** *** *******, ******* **** ***** with * **** ******* (******* ******* ** *******), *** ********** the ******* *** ****** *** **** **** ** * **** way ** ********** ********. *******, *** *** ********** ****** ******* in * *********** **** *** ****** ** ***** ********** ***** like *********** ***** ** **********. 

********* ****** ****: *** ** *** ******* ******** ** ****** ***** *** that *** *********** ***** ******. **** ****, *** ****'* ***** of ************** ** **** *** ****** ****** *****. *** **** *** most ************* ****** ** ********* ***** ******* ** **** *** simply ** ****** **** ** * ******* *****. *** ********* of ******* ******* ** *** ********** ** *****, *** ******* with **** **** *** ****, ******** ***** ****** ***** ********* the ***** ** ****'* *****.

************: ******* *** ****** ** ******* ** ****** ******** *** to ******* **** **** **** **** *** **********. *** *******, requiring ***** ***** **** ********** ***** *** *** ************ *** the ***** ****** ** ******** **** ******* ****/****** ***** ** shared ***** *** ** ************ ****. *******, *** ******* *** ****** addition ******* ********* ****** ** ******** **** ** ********** ******* openings *** *******/*********** ********* ***********. 

Scramble *******

**** ******* *** **** ****** **** ******. * ******* ****** 'scramble ****' ** '****** ****' ** *** ******* ********* ****** in * *********** "*-*,*" ***********, *** ******* ********* *** ****** every **** **** *** ****. *** ********** ********* *** '****** wear' *************, *** ****** *********** **** ***** *** *******. *** common ***** *** ***** *****:

****: ********** *********** ** ****** **** **** * **** ******* in * ****, ****** ** ****** ****** ******** ** ***** of *** ****.

****: **** ********* (~$*** - $****, ******** ** 'non ********' *****) *** *** ****** ********* ** *** *** system.

Comments (14)

Many keypads on public areas (gated communities, certain buildings) that might require emergency responder access often have a code like "0911" or "9110", which further reduces their overall security.

Hey Brian,

Another good article thanks. Quick comment...not sure about labeling this method of access worst or best or anything else. It can be a very feasible security option in many applications...when considering specific criteria and customer needs. It is one factor authentication and certainly has limitations as you properly point out.

Last comment....many keypads (even inexpensive stand alone types) have non-volatile memory for multi codes/users. So if used effectively will mitigate or eliminate the issue of revealing keys using just one code. Still codes need to be changed for everyone time to time as you suggest.

Thanks.

Thanks for the feedback, Marc.

This didn't make the official "don't" list, but you should not write the valid code and tape it up near the keypad, either:

I definitely agree of course, but have worked at one place (a nursing home) where the code to get out of a secure building is noted above the keypad - dementia sufferers have no idea or quickly forget what the numbers are about so they can't easily "escape"/ wander off, but everyone else is easily and safely able to exit at any time. It wasn't my idea but seemed to work OK in that particular site.

We had these at a facility I used to work at. The scramble pads are pretty neat, especially in a card+PIN configuration.

We have from time to time received the access card from a departed employee and found it to have the code for turning off the BA system written on it! I imagine this might happen with PIN codes, too. Silly people...

And the release of the FLIR One attachment for the iPhone just made it that much less secure:

Good advice. But please don't share with my wife. Making sure the gas knobs on the stove are off stresses her out enough.

Tell her to use her nails when punching in pin codes. No need to explain further :)

nice video... very interesting uses...

Found all information very interesting. Never realized there was so much to consider when thinking about readers and key pads.

Low tech

I agree with this article big time. This has to be the most easily manipulated access entry device. Great examples above.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on Access Control

Favorite Access Control Manufacturers 2018 on Apr 26, 2018
150+ Integrators told IPVM "What is your favorite access control management software/system? Why? Unlike the 2016 access favorites where a group...
Favorite Biometrics 2018 on Apr 23, 2018
Biometrics are on the rise, or at least integrator opposition to them is declining, according to new IPVM integrator statistics.   Almost half of...
Dedicated Vs Converged Access Control Networks (Statistics) on Apr 20, 2018
Running one's access control system on a converged network, with one's computers and phones, can save money. On the other hand, hand, doing so can...
Worst Access Control 2018 on Apr 18, 2018
Three access control providers stood out as providing the most problems for integrators. In this report, we analyze the answers to: "In the...
Key Control For Access Control Tutorial on Apr 16, 2018
End users spend thousands on advanced systems to keep themselves secure, but regularly neglect one of the lest expensive yet most important aspects...
Alarm.com Business Market Expansion on Apr 13, 2018
Alarm.com has millions of subscribers, but the company has traditionally been mostly a residential/home focused offering.  ADC's new Smart Business...
Average Access Control Project Size 2018 on Apr 10, 2018
  The most common access control project size is 5 - 16 doors per project. This 2018 result mirrors previous statistics, most recently in 2016...
ISC West 2018 Access Control Rundown on Apr 06, 2018
For ISC West 2018, what is new and interesting in access control?  This rundown will bring you up to speed on the exhibitors, what they are...
VMS New Developments Spring 2018 (Avigilon, Exacqvision, Genetec, Hikvision, Milestone, Network Optix) on Apr 04, 2018
What's new with VMS software? In this report, we examine new features and releases for Spring 2018 to track different areas of potential...
Forced Door Alarms For Access Control Tutorial on Apr 04, 2018
One of the most important access control alarms is also often ignored. "Forced Door" provides a vital and even critical notification against...

Most Recent Industry Reports

Favorite Access Control Manufacturers 2018 on Apr 26, 2018
150+ Integrators told IPVM "What is your favorite access control management software/system? Why? Unlike the 2016 access favorites where a group...
Last Day Save $50 - May 2018 Camera Course on Apr 26, 2018
Today is the last day to save $50 on early registration. Register now (save $50) for the Spring 2018 Camera Course This is the only independent...
Hikvision DarkfighterX Vs Darkfighter PTZ Tested on Apr 26, 2018
Hikvision has focused on improving low-light performance for PTZs, an area that has traditionally been a problem, even more so than fixed cameras,...
Digifort VMS Profile on Apr 25, 2018
Digifort, a Brazilian company, has a strong presense in their home country. In a crowded and mature Enterprise VMS market, will they be able to...
Death Of A Dummy Camera Manufacturer on Apr 25, 2018
5 years ago, IPVM gathered insights from a dummy camera manufacturer, who was then the top selling dummy camera provider on Amazon and 3rd in all...
Hikvision Critical Cloud Vulnerability Disclosed on Apr 25, 2018
Security researchers Vangelis Stykas and George Lavdanis discovered a vulnerability in Hikvision's HikConnect cloud service that: just by...
The Yolo Bro And The Death of Journalism on Apr 24, 2018
There's an old quote: The job of the newspaper is to comfort the afflicted and afflict the comfortable Unfortunately, the opposite is more...
DMP Adds Ring Video Doorbell Integration on Apr 24, 2018
Video doorbells have become one of the hottest items for security systems. After several years with no doorbell, DMP has announced integration with...
Milestone 2017 Financials Examined on Apr 24, 2018
For ISC West 2018, Milestone released ... their financials, touting "strong revenue growth in 2017". However, there were discrepancies with the...
Chinese Manufacturer Kickstarter Campaign Huge Success (EverCam) on Apr 23, 2018
In a week, a Chinese manufacturer's expertly done Kickstarter campaign has received $1.4 million in pledges, an incredible amount for a video...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact