About the business
I run a small finance office. Our door readers were old, and the installer proposed new ones.
The problem
He said, "These are OSDP, so they're secure."
That sounded too easy.
I looked it up. Wiegand, the old way readers talk to controllers, is one-way and effectively plain text. OSDP is a two-way standard (IEC 60839-11-5, from 2020) and can encrypt the link with Secure Channel, using AES-128.
But security researchers have shown OSDP can be weakened if readers are left in install mode with the default key.
What we did
We turned that into a handover checklist:
- Are the readers and controllers both OSDP?
- Is Secure Channel on for every reader?
- Were all readers taken out of install mode?
- Were the default keys replaced with our own?
- Who holds the keys?
- Does any reader fall back to Wiegand?
- Is there a test record for each door?
The installer found two readers still in install mode.
The result
He fixed them before handover, and we got the keys in writing.
What I'd tell anyone now: OSDP gave us a stronger option, not a guarantee. The setup made the difference.
Download the reader handover checklist (CSV) and run it on every reader before you sign off.
The cards matter too. Here's how one office found out which of theirs could be copied.
Getting new readers installed? Tell us what you're being offered. We'll go through the handover checklist with you, so 'secure' actually means secure on the day you sign off.
Free door-by-door access review
Send us your door list, or just tell us what's behind each door. We'll reply with the weak spots and what to fix first, cheapest first.
- Free
- Reply within 24 hours
- No obligation