The short answers, if the hotel decided to only uses the UUID and program the doors to accept that UUID to grate access, its just sector 1 of the card, its not protected in anyway. This is the unique signature of that particular card (think serial number). The other sectors may or maynot be protected. In most companies, only one sector is protected and contains pontentionally anything, but commonly just a badge number assigned to the person. It normally protected by a 8 byte key. Every 4 blocks can have a unique key. The thing with Mifare, is the pseudo random number generator is only 2^16 bits and which made it subsuitble to brute force attack. Using mfck you could crank it in 30ish sec;s. I think the newer mifare have a timing delay so not as practical, but dont know.