Hotels increase security by changing media formats
by Chris Josephes
For those curious, the title I chose was just a wee bit sarcastic.
It's an interesting read, but there's no in-depth conclusion as to whether or not there was any real security concern in the beginning. If the hotels are changing the format of the cards, are they acknowledging that there is a risk?
If you designed a card system right, it would contain the smallest amount of data possible: A true random 64 or 128 bit integer (or maybe more) that is shared only by the card and by the door lock it's associated with. If the card is lost, it's worthless to anyone who finds it; unless they're ballsy enough to try every single door in the hotel.
But now there's the possibility that the cards may contain personal data. No hotels have been explicitly named, so it's hard to tell if this is a widespread issue or just a few isolated cases.
If I were to guess, I'd say that the hotels that do add the data are the ones that give you extra services. If the hotel mentions your card can do extra stuff like buy food, or enter the Magic Kingdom, then it probably contains personal information.
If the hospitality information wants to help alleviate these fears, then they should keep their guests informed. Guests should be told that they explain to guests that lost or stolen cards should be reported immediately, and they should disclose the consequences of what could happen if a card was misused.
Buying into new technology like smart-cards or proximety cards, only adds a layer of obscurity by using a less common media format. And hotels would ironically drive down the cost of smart card technology, since there will be an increased demand to build readers for every one of their doors. Magnetic card readers can start at around $100 (for reading tracks 1,2, and 3). Ironically, you can purchase smart card readers for even less than that.
So either way, you're still stuck with the need to take proper precautions with your cards. Once you're done with your hotel stay, it be cut, chopped or shredded. If you need to keep the card, it needs to be kept in a secure place. If it's lost or stolen, the hotel should be made aware of it right away.