the hid readers just output a pain text to the access control system, there is nothing secure about that.. the security lies in.. make a card that that hid reader will read with my id on it.. now there's the trick.
reading em is easy, emulating one is hard.. because the reader does the crypto handshake, its all transparent like its supposed to be
crack these cards and you can get in to anything, but they havent been cracked yet.. some of the early ones have been but Ive not seen any of those in eons
most of the time you configure the card reader to output the ID with a prefix and postfix, consider this a seed.. if you unplug my card reader and plug in a USB keyboard and type in the ID from my key.. it will fail, because it will not have the prefix, delimeter, and postfix I have programmed into the reader to wrap around my ID.. and it checks for the whole thing... the config is written one way and not read so if you unplug the reader you cant easily figure out what its config is.
my program is also looking for the specific USB ID and SN of the prox reader and not just any keyboard, so that could slow you down a bit too.. by then the 30's timeout is up and the alarm is going off.
for enabling and disabling my alarm system its adequate, I have a pin-key to get inside and no key.. so for 2 factor I have the thing I know (8-digit pin to unlock) and the thing I have (hid fob to disarm).. ass backwards but I dont like keys, cant revoke em.. its just a residential front door, so I just have to be more secure than those around me
Went with Z-Wave because it provides a lil bit of crypto at least, and it still wont disarm the alarm system so I consider it more difficult than just picking the deadbolt.. really like having the dead bolt auto-lock, know nobody leaves things unsecured.. and with keypad nobody gets locked out in there jammies in winter.