7 ms·

I was considering getting some of these devices but things like this scare the fuck out of me. Let alone if Nest goes away you end up with some useless bricks.

I was considering getting some of these devices but things like this scare the fuck out of me. Let alone if Nest goes away you end up with some useless bricks. Any suggestions for self hosted smart locks?

Klathmon 8y ago
Go with zwave. There are some gotchas (make sure you get a zwave-plus lock that incudes the AES security stuff), and you need a dedicated "hub" to communicate with it, but they are rock solid in my experience
jclardy 8y ago
I went Z-Wave with home assistant. Not the easiest in terms of setup, but everything is run locally (I started on an rPi but am now transitioning to a Intel NUC.)
- Klathmon 8y ago
  I did the same, and I couldn't be happier with it. Home assistant is open source, written in Python, has a web based UI, and integrates with everything under the sun and is VERY welcoming to new components from outside people. I've contributed 2 so far, and I hope to have another that adds in daily electricity monitoring from my local power company ready soon. Hass is quite possibly the best run open source project I've ever been involved in.
samstave 8y ago
Schlagg
verandaguy_alt 8y ago
Coming from an infosec background and having touched on physical security, just don't use a smart lock: - Best case, even with a responsible implementation, you're introducing more variables than are necessary into a supposedly secure system. If one of your dependencies fucks up, your lock is exploitable. - Worst case, you have a typical IoT device, where the "S" stands for "security." - In _either_ case, you're likely still going to include a physical lock mechanism for keys as a backup -- so you're basically just increasing the attack surface (significantly, I should add) by doing this. Smart locks are currently high-risk appliances, and I'm fairly confident that most others with a security background will agree with me on that.
- Uberphallus 8y ago
  What would you do if you rent an apartment to several people per week? Because even "don't copy" keys can be copied.
  - mynameisvlad 8y ago
    Most smart locks only replace the "back" part of the lock anyway, or augment the physical key slot to leave it as a backup, so, the point still stands that it only introduces new attack vectors. You'd still have the problem of someone being able to copy your "do not duplicate" key not to mention bumping/picking the lock, along with hacking the smart portion of the lock. In the end, it's your decision, but the OP's comment stands fully: all the same attack vectors still exist, along with a bunch of new ones at the expense of convenience.
    - steve_musk 8y ago
      I the the idea was you wouldn’t have to give out the key to renters and could just give them passcode/phone access, so it actually would be removing an attack vector.
    - dragonwriter 8y ago
      > You'd still have the problem of someone being able to copy your "do not duplicate" key Only if you distribute the “do not duplicate” key, but the whole point is to not do that.
  - sitkack 8y ago
    Use a keypad controlled, reprogrammable door lock. No internet required, codes easily rotated. https://www.homedepot.com/b/Hardware-Door-Hardware-Door-Locks-Electronic-Door-Locks/N-5yc1vZc2bd https://www.homedepot.com/b/Hardware-Door-Hardware-Door-Lock...
  - verandaguy_alt 8y ago
    If you're comfortable using a totally (physical) keyless solution, try a hotel-style mag strip-based access card, or an NFC alternative like a ProxCard. AFAIK, most code-based locks include a physical lock cylinder as a backup.
willsinclair 8y ago
I don't really see the appeal of smart locks. It doesn't add any convenience, since you could always just lock the door on your way out. That being said, I think regular passcode locks without internet connectivity do add a convenience since you don't have to carry a key.
- mavhc 8y ago
  However they're pretty much all terrible, security wise. And how do you tell who knows the passcode at any point in time?
- Uberphallus 8y ago
  I rent an apartment on Airbnb, and handing out keys to every single guest is way worse from a security standpoint. I prefer to create users, authorize, delete them than rekeying the lock every once in a while.
dangrossman 8y ago
It shouldn't scare you that much. Without the Nest servers, all you lose is the remote control/monitoring features, your devices don't become useless bricks. The Nest thermostat would still be an attractive, interactive thermostat with a color screen and tons of features. Without an internet connection, the $250 thermostat doesn't turn into a brick, it turns into a $150 non-connected thermostat. The Nest Protect smoke detector still alerts you to fires or carbon monoxide, with voice warnings, and a lighted path at night. Without an internet connection, the $120 detector doesn't turn into a brick, it turns into a $40 non-connected talking smoke/CO alarm. The Nest smart deadbolt still lets you lock and unlock your door with either a key or a PIN code. Without an internet connection, the $280 smart deadbolt doesn't turn into a brick, it turns into a $100 keypad deadbolt. People lose their internet connections for all kinds of reasons, and the majority of smart home devices you can buy continue to be premium devices in that state, better than the basic thermostat/detector/lock/light/etc they likely replaced.

Klathmon 8y ago

Go with zwave. There are some gotchas (make sure you get a zwave-plus lock that incudes the AES security stuff), and you need a dedicated "hub" to communicate with it, but they are rock solid in my experience

jclardy 8y ago

I went Z-Wave with home assistant. Not the easiest in terms of setup, but everything is run locally (I started on an rPi but am now transitioning to a Intel NUC.)

Klathmon 8y ago
I did the same, and I couldn't be happier with it. Home assistant is open source, written in Python, has a web based UI, and integrates with everything under the sun and is VERY welcoming to new components from outside people. I've contributed 2 so far, and I hope to have another that adds in daily electricity monitoring from my local power company ready soon. Hass is quite possibly the best run open source project I've ever been involved in.

samstave 8y ago

Schlagg

verandaguy_alt 8y ago

Coming from an infosec background and having touched on physical security, just don't use a smart lock: - Best case, even with a responsible implementation, you're introducing more variables than are necessary into a supposedly secure system. If one of your dependencies fucks up, your lock is exploitable. - Worst case, you have a typical IoT device, where the "S" stands for "security." - In _either_ case, you're likely still going to include a physical lock mechanism for keys as a backup -- so you're basically just increasing the attack surface (significantly, I should add) by doing this. Smart locks are currently high-risk appliances, and I'm fairly confident that most others with a security background will agree with me on that.

Uberphallus 8y ago
What would you do if you rent an apartment to several people per week? Because even "don't copy" keys can be copied.
- mynameisvlad 8y ago
  Most smart locks only replace the "back" part of the lock anyway, or augment the physical key slot to leave it as a backup, so, the point still stands that it only introduces new attack vectors. You'd still have the problem of someone being able to copy your "do not duplicate" key not to mention bumping/picking the lock, along with hacking the smart portion of the lock. In the end, it's your decision, but the OP's comment stands fully: all the same attack vectors still exist, along with a bunch of new ones at the expense of convenience.
  - steve_musk 8y ago
    I the the idea was you wouldn’t have to give out the key to renters and could just give them passcode/phone access, so it actually would be removing an attack vector.
  - dragonwriter 8y ago
    > You'd still have the problem of someone being able to copy your "do not duplicate" key Only if you distribute the “do not duplicate” key, but the whole point is to not do that.
- sitkack 8y ago
  Use a keypad controlled, reprogrammable door lock. No internet required, codes easily rotated. https://www.homedepot.com/b/Hardware-Door-Hardware-Door-Locks-Electronic-Door-Locks/N-5yc1vZc2bd https://www.homedepot.com/b/Hardware-Door-Hardware-Door-Lock...
- verandaguy_alt 8y ago
  If you're comfortable using a totally (physical) keyless solution, try a hotel-style mag strip-based access card, or an NFC alternative like a ProxCard. AFAIK, most code-based locks include a physical lock cylinder as a backup.

willsinclair 8y ago

I don't really see the appeal of smart locks. It doesn't add any convenience, since you could always just lock the door on your way out. That being said, I think regular passcode locks without internet connectivity do add a convenience since you don't have to carry a key.

mavhc 8y ago
However they're pretty much all terrible, security wise. And how do you tell who knows the passcode at any point in time?
Uberphallus 8y ago
I rent an apartment on Airbnb, and handing out keys to every single guest is way worse from a security standpoint. I prefer to create users, authorize, delete them than rekeying the lock every once in a while.

dangrossman 8y ago

It shouldn't scare you that much. Without the Nest servers, all you lose is the remote control/monitoring features, your devices don't become useless bricks. The Nest thermostat would still be an attractive, interactive thermostat with a color screen and tons of features. Without an internet connection, the $250 thermostat doesn't turn into a brick, it turns into a $150 non-connected thermostat. The Nest Protect smoke detector still alerts you to fires or carbon monoxide, with voice warnings, and a lighted path at night. Without an internet connection, the $120 detector doesn't turn into a brick, it turns into a $40 non-connected talking smoke/CO alarm. The Nest smart deadbolt still lets you lock and unlock your door with either a key or a PIN code. Without an internet connection, the $280 smart deadbolt doesn't turn into a brick, it turns into a $100 keypad deadbolt. People lose their internet connections for all kinds of reasons, and the majority of smart home devices you can buy continue to be premium devices in that state, better than the basic thermostat/detector/lock/light/etc they likely replaced.