14 ms·

Landlords forcing smart locks on tenants

128 points by Lio 8y ago

lordnacho 8y ago
Is it impossible to do this safely? Just like with my car, it would be really convenient when holding kids and a load of their stuff to not have to fish out the keys. I suppose there's the issue of your landlord locking you out if they're unhappy with something, but surely that is not purely a technological issue.
- who-knows95 8y ago
  it's more just the huge risk right? so many factors become part of the threat model, when you could stick to the physical lock, and really limit it. https://twitter.com/internetofshit?lang=en https://twitter.com/internetofshit?lang=en is a pretty good example. you could make a rfid chip reader part of your lock, but even that has weakness. http://www.astclock.com/astclocks-blog/advantages-of-rfid-door-locks/ http://www.astclock.com/astclocks-blog/advantages-of-rfid-do... tldr: limit your damn threat model/inconvenience.
  - Thorrez 8y ago
    I don't think security of entry to the apartment is the main concern (because most locks can be picked fairly easily, and criminals force doors regardless of lock). I think privacy, network security, and availability are the bigger issues.
    - who-knows95 8y ago
      well, i do agree, the network and availability are my main issues. if a criminal is going to break you door, it's going to happen. but, i think people would be more suspicious of someone picking a door lock, rather then waving a Chip and the door allowing them access. i know, alot of hotels weren't surprised to learn their room doors were amazing weak. https://www.wired.co.uk/article/hotel-hack-digital-lock-door-system-fsecure-assa-abloy https://www.wired.co.uk/article/hotel-hack-digital-lock-door... if you want a good physical lock the ANSI Grading System is a good place to start.
- Lazare 8y ago
  In theory, yes, it's possible to do this safely. But offhand I can think of several horror stories about smart locks, and no good stories. The tech just seems absurdly immature at this point. And this product, in particular, is apparently known for glitching and not working, so...
  - daxterspeed 8y ago
    On top of the software aspects many smart locks neglect the actual locking mechanism leaving the lock vulnerable to easy tricks like shimming. Smart locks also have to consider how they'll function without electricity. An exposed slot for a battery could let an attacker instantly fry the lock from the outside.
    - 300bps 8y ago
      An exposed slot for a battery could let an attacker instantly fry the lock from the outside. A long time ago I got drunk at my birthday party so my wife drove us back to the beach house we rented. She parked my car so that it was about five inches overhanging someone’s driveway. Their driveway wasn’t blocked but it was a dick move and they retaliated by shaving off candle wax into my car’s door locks. Fortunately I always used remote unlock but back then most people still used physical keys to unlock their car. People can mess or destroy any lock. There are legitimate concerns about electronic locks for sure but I don’t understand setting the bar so much higher for them than mechanical locks.
      - michaelt 8y ago
        I don’t understand setting the bar so much higher for them than mechanical locks. Based on the smart lock reviews I've seen on youtube channels that review locks, rejecting 98% of smart locks on the market doesn't require that you hold the smart locks to a higher standard than the mechanical locks. Because the reviews I've seen indicate almost all smart locks fall a long way short of the security of equally priced mechanical locks.
      - daxterspeed 8y ago
- KingMachiavelli 8y ago
  Key code locks are pretty convienient since you don't even need a phone yet aren't connected to any externel network and they allow a normal key to be used as a backup. A lot of them can be hooked up to the internet vie Z-wave or similar but they don't have to be.
  - TarpitCarnivore 8y ago
    Even better are the ones that are keypads + smartlock. We'll probably be swapping over to one of the Yale locks which has a keypad & uses August's tech for the smart part.
- detaro 8y ago
  Just local RFID tokens without internet connection? If you use a system with properly secure tokens that's probably a relatively safe option. Same with key codes: internet management is not really needed for that. Of course access could be properly secured, but vendors have a really bad record of actually getting that right.
  - johannes1234321 8y ago
    The tokens being secure is not enough. The system also has to check latency etc. to prevent repeater attacks. Imagine a scenario like that: You leave your car in a parking lot. One attacker follows you with a repeater. Once you're around the corner the second attacker approaches your car and opens it via the repeated radio signal and starts it. A while ago there had been a small debate on this topic, as attackers actually used such an approach to break into cars (sometimes even stealing them) https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can-steal-car/ https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...
    - smileysteve 8y ago
      A code repeater seems like a lot of work when standard tumbler locks are bypassed by a credit card, $10 lock pick set, a strong kick.
      - johannes1234321 8y ago
        According to that wired article the repeater is $10 as well and lockpicking needs a little practice and skill, using a repeater not. :)
    - tialaramex 8y ago
      You can sidestep this if the token needs to be explicitly activated. Unlike turning a key in a mechanical lock this needn't be something that requires dexterity, just any positive action e.g. pressing a button.
- skywhopper 8y ago
  Car locks are one thing. They are hackable, but only in a very targeted and location-specific manner, basically the same risk as a physical key. But this is a centrally controlled system in which your landlord and a third party you have no control over are monitoring your movements and can remotely unlock the door via an Internet-connected device. So it's remotely monitorable and hackable. And since there's no physical presence required to monitor or hack it, it's actually a much bigger risk than remote car locks. Also, cars are very different than homes. Typically we don't store truly valuable and irreplaceable items in our cars, unlike our homes. Typically we don't sleep in our cars, unlike our homes. You can easily see if someone is approaching your car, or trying to get in, when you are in it. Not necessarily the case with your home.
random_kris 8y ago
wow making such a drama on twitter because of this? I find it kinda funny to get triggered like that and having the need to make everything public.
- thecatspaw 8y ago
  I could imagine that you would not just want to stand by and do nothing if you suddenly have to move because the landlord just made your appartment very insecure
- Lazare 8y ago
  I think you're really underestimating how serious this is.
- Thorrez 8y ago
  If many people want to fight against something, making it public helps those people to find each other and organize. From some of the tweets, other people in similar situations have reached out to her.
- thatfrenchguy 8y ago
  You've never had a bad ex did you ?
- ben_w 8y ago
  > Some gems include the fact they don’t seem to realize the directly connected smarthub is an attack vector for the zwave smart devices, which they never patch. > And they can’t describe a patch SLA or what they’ll do in a couple years when their Zipato hubs aren’t updated anymore. > Been chatting with other security folks who brought this up and they were totally dismissed. Vendor couldn’t state they took basic measures like hashing and salting lock pins. If this was optional, fine, choose not to have it. But this isn’t optional, it is mandatory for all property managed by the same group, over the head of the landlord.
- triggered 8y ago
  Using the “triggered” buzzword to signal that this is another frivolous SJW anxiety, and yet this is not SJW related at all. This is a ligitimate security issue, since internet-enabled locks are never going to be secure enough to trust your life with, and even if one brand works well, most landlords will not be technically equipped to sort the differences out on there own, and will wind up deploying these locks before expert researchers can evaluate them. Working resonably-secure locks or not, what happens when the mothership goes down? When the domain gets hijacked? When wi-fi gets jammed? When wires get cut. Really sophisticated two stage attacks are being used on car security systems already. Step one, damage the internet link and wait. Step two, when the link is down the car’s security is defeated, and may be safely stolen. Oh look. Another buzzword. Get gaslighted.
paulie_a 8y ago
Why are they going full iot and smarthub with an app? My building uses rfid key fobs and it's great. Temporary ones can be made by calling the front desk.
- thisismyaccoun7 8y ago
  I believe I live in a complex owned by the same company as the Twitter user, and if so, I can answer that. The owners aren't installing it themselves but going through https://smartrent.com/ https://smartrent.com/. As you can see from their homepage, the benefits of the smart home features are aimed at owners/landlords/property managers primarily, with renters' benefits being secondary. Those landlord benefits come from online automation.
gambiting 8y ago
I mean......yes, it does look terrible and I would not want to have this installed in my house. But on the other hand....our landlord does have a physical copy of the key to our house. I consider this to be a good thing, not a bad thing though! Probably made even better by the fact that legally the landlord has to give tenants 24 hours notice if they want to gain entry(in the UK). They can't just come over whenever without telling me first.
- maccard 8y ago
  > our landlord does have a physical copy of the key to our house. I This should only be acceptable in the case where your landlord is also your property manager. If they're not, then your letting agent should have a copy of a key. On the 24 hours note, in 8 years of renting in the UK, I can only remember one instance where I was actually told 24 hours in advance. I was usually emailed at 5pm saying "hey, we have someone coming around for X tomorrow at 9:30, we will let them in". I told them no but they still came every time.
  - gambiting 8y ago
    >> "hey, we have someone coming around for X tomorrow at 9:30, we will let them in". I told them no but they still came every time. Then they were breaking the law, and almost certainly the letting contract. The only question is whether you want to do anything about it or not(legally) - most people don't want to go and fight with their landlord over a repair happening with less than 24 hours notice. I only had to do this once - our landlord wanted some work carried out in less than 24 hours from telling me and I said ok, but you need to give us at least 24 hours notice, come back the next day - and they did.
  - handzbagz 8y ago
    You can legally change the lock if you change it back when you move out.
    - pintxo 8y ago
      This: my current lock has been used in three different cities.
KeepFlying 8y ago
Horrifying. I hope she ends up winning a case on this. Even if it is just to get to move out early for free at least it's something. But wow. I'd be doing the same as her if this were forced on me. I love IoT things. But I draw the line at door locks. Physical security is already difficult enough. I'm not adding more attack vectors to that. Not to mention the data exfil that will most definitely happen with that system. I'm confident that even if the lock itself ends up being secure that the data that gets given to the landlord won't be protected at all.
fabian2k 8y ago
A "smart" lock without a fallback to a physical key. Uses a 4 digit code and locks you out after 5 tries. This is truly terrible even beyond the usual privacy and security concerns a smart lock introduces. And those concerns are far from trivial, this sounds like a privacy nightmare and also gives far too many people potentially access that shouldn't have.
- talltimtom 8y ago
  It also locks you out after that neighbor you don’t like intentionally types a wrong code five times, because you where playing loud Music yesterday until 21:00, which isn’t against the rules but he/she doesn’t like it. Extremely smart.
  - regularfry 8y ago
    To be fair, a tube of superglue has a similar effect on a dumb lock.
    - BlackFly 8y ago
      Pushing buttons doesn't scream vandalism like inserting glue into a lock does. As a less vandalism like attack, consider when your drunk neighbours attempts to enter your apartment instead of their own. The security "feature" of a lock out is just an easily triggerable denial of service attack.
      - Nerdfest 8y ago
        I like doing it to corporate security folks after they try to dictate it in authentication systems. They usually seem to understand after it's done to them.
        BlackFly 8y ago
        Oh, I like that approach. I will have to remember this "argument" against lock out.
nicolas_t 8y ago
Is there any secure smart lock? I would want one because I'm away 3 months a year and it would simplify renting my apartment on airbnb when I'm away (especially with the rent I pay in HK) but I'm also rather worried about the security implications. And from my brief research, a lot of vendors have very little documentations about security. I would obviously only consider one that has a fallback to an actual key.
- justtopost 8y ago
  Not that ai have seen. Check out 'the lockpicking laywer' on youtube for details on many models. He only focuses on physical security however.
- smileysteve 8y ago
  Define secure? A keyed tumbler lock can often be bypassed with a $10 kit and an hour's training via YouTube. Alternatively, without a frame reenforcement kit, a lock is bypassed with a strong kick. Finding a software hack is probably the least of your worries.
  - 300bps 8y ago
    Technically savvy people can think of lots of ways to overcome technology. It’s easy to get hung up on the problems with something new while ignoring the problems of current systems. In addition to what you said, people often leave mechanical locks unlocked on at least one or more windows or doors. People often have easily broken glass on their doors. It’s commonly said that most locks are “courtesy locks” because they’re so easy to defeat. So I don’t understand many of the security concerns surrounding electronic locks. Privacy and failure concerns I can understand though.
  - nicolas_t 8y ago
    That leads to a question I had recently, I know that some insurance will only reimburse in case of thefts if there's sign of a break-in. If someone lock-picks the lock, is there a trace of a break-in? Would such thefts be covered?
Shivetya 8y ago
Realtors and home renting companies use these near me. Signs that say "Let yourself in" and you can get a temporary code to go into a rental and such. From a privacy stand point there are many concerns but when renting or leasing you are already bound by laws requiring you to admin maintenance and even owners with sufficient notice. Notice timeliness is all based around the nature of the call. Plus on a safety side, elderly people could have locks opened for emergency persons by a central clearing system similar to how some home security systems are managed. In the long run, you opt out by living somewhere else or owning your own place. There are both pros and cons and we need to focus on both and not one or the other. edit: Another service/feature/etc I have seen lately is bundling standard utilities into the lease with surcharges for exceeding caps (electricity, gas, and water). This relieves the landlord of headaches and new residents from having issues getting services started
- skywhopper 8y ago
  Sure there are potential positives, but the current state of the art is not ready for this, and if you read the thread, it's clear this particular vendor is absolutely not handling the requisite security concerns in the right way. In any case, there's no good reason not to have a physical key for a fallback. What happens during a power outage and the Internet is down? How is this thing powered anyway? Batteries are a major problem. And again, if it's hardwired, that's also a risk.
- Merad 8y ago
  These aren't necessarily the same thing. When I was looking for a rental house about 6 months ago, essentially all of the homes I visited were set up with a "smart lockbox". You had to set up an account with a 3rd party service who required a picture of a photo id and a small fee ($5 for 30 days access, IIRC). The rental listings would ultimately link to the 3rd party service where you could schedule a visit to the house, then get a temporary code to access the key when you arrived. All of the homes still used traditional physical locks. I'm not a fan of "smart" devices, but think this was actually a great service as long as the home is unoccupied. As a tenant I was able to easily visit a dozen different homes in one day without having to spend hours on the phone scheduling visits with property managers.
scoot_718 8y ago
I'm shocked a landlord would willingly seek out this amount of legal liability. Home Contents Insurance companies take note - these guys are asking for it.
rlpb 8y ago
Clearly it wouldn't be reasonable to impose a lower standard of safety and security than a non-smart lock. I don't think landlords would attempt to argue that principle. The argument from them will be that smart locks do not regress security and safety. Given the widespread and well known security problems with IoT devices across the industry, I think it'd be reasonable to demand assurances on this. For example, an audit trail provided to the resident for every unlock event and who authorised it, an agreement to immediately revert indefinitely to a physical lock at the landlord's expense if a vulnerability is discovered, and daily financial compensation for every day that the landlord fails to act on these mitigations. Anything less than this I'd argue is a breach of contract, and any requirement that doesn't provide similar assurances would have to be by agreement by the tenant (ie. a new contract signed).
- deleted 8y ago
  [deleted]
- privateSFacct 8y ago
  Breach of contract? Huh? Most tenants do not have "audit trail" requirements in their contracts and their existing physical locks don't provide one. I always wonder if the folks making legal claims on hn actually practice law - the arguments are often nonsensical. Or maybe this type of logic is why law seems so backwards to folks
  - rlpb 8y ago
    > Most tenants do not have "audit trail" requirements in their contracts and their existing physical locks don't provide one. No, but the contract was signed at a time when physical locks were the only norm and the security and safety characteristics of a physical lock can be considered to be implied by that contract. [For example a typical rental contract does not say "the landlord will maintain a working and suitable lock on the front door" but clearly a landlord would nevertheless be in breach of contract if the lock needed replacing due to wear and tear and the landlord refused to fix it] This wouldn't rule out installing a smart lock in the future, but only if the security and safety characteristics, as implied by the contract, are not regressed by doing so. A remote unlock facility wasn't agreed by the tenant, so it's reasonable to ask for an audit trail requirement in this case as previously the landlord (or their agent) would have had to be physically present, so their memory would serve as an audit trail. I think that the perspective that [the addition of] a remote unlock facility without an audit trail compromises the security and safety of a physical lock and thus breaks the implied contract is a perfectly reasonable argument, especially given the prevalence of general industry failure (known vulnerabilities in specific models) in this area.
mrweasel 8y ago
There's no a single IoT device available that I would want to install in my home, let alone a lock. I can understand the need for IoT device in industry, such as remote monitoring of device in the field. For home use I have yet to see a device that make any sense. IoT is at this point complete marketing hype, and very little practical application.
- KozmoNau7 8y ago
  I feel the same way, I explicitly avoid any device described as "smart". I don't need a "smart" blender or microwave or coffeemaker or refrigerator or anything else. The only two exceptions are my phone (hard to avoid) and my radiator thermostats. For the latter, they are connected to the internet and I can adjust temperature and put them in "holiday mode" from an app or web page. However the control box doesn't require any firewall holes or port openings, as far as I can tell it gets updates by sending a HTTP request to the same online portal where I can control my heating schedules. It communicates with the thermostats and window sensors on some kind of RF protocol similar to Z-wave, but if someone goes to the effort of hacking that just to mess with my heating, I would actually be a bit flattered. I probably wouldn't choose the internet-connected version again. Even though it is a lot easier to setup and manage, I think I would prefer the "dumb" standalone units. They're a bit more fiddly to setup initially, and you have to put each of them to holiday mode manually. But I would prefer to not have them connected to any kind of network. I used to be the type of person who wanted everything 100% connected 100% of the time. Over the last couple of years, I've taken a pretty hard turn in the opposite direction, I prefer to have everything as simple and standalone as possible.
- apexalpha 8y ago
  >For home use I have yet to see a device that make any sense. Slightly off-topic but I have a thermostat that only turns on when my phone (or me) is on the way home and it automatically turns it off when I leave my home. It saves me _considerable_ amount on my heating bill, especially since I'm not home on a regular schedule and often don't know until hours in advance.
  - telesilla 8y ago
iwasakabukiman 8y ago
Can we change the title to “landlord”? I’m only seeing on person saying this is happening to them on Twitter and the title makes it sound extremely sensationalist.
- wink 8y ago
  In the thread it's stated that it's probably for a few thousand apartments if I'm not mistaken - not a single building/landlord. (Bit unsure about the exact categorization here, if the landlord is just outsourcing building management.)
- thisismyaccoun7 8y ago
  My complex's owners are doing this, and from the person's details on Twitter, it looks to be the same company. They own properties in 22 US states with 250,000 residents according to their website.
scotty79 8y ago
I recently got keyless car. Now I want something like that for my apartment door very much. No fumbling with the key. Just grab the handle and doors open.
HelloNurse 8y ago
What about connecting the lock to your network, collecting full network logs, and having the landlord arrested for hacking as soon as the wrong packet comes out of the device?
- mnw21cam 8y ago
  The landlady is having this forced onto her, so I would think the proper target would be the big org pushing the change.
- Faaak 8y ago
  I suppose that the lock only talks with a central server via an encrypted connection, so you wouldn't see any proof
calgoo 8y ago
I dont know how your system works in the US, but here in Spain, I change the lock when i move into a rented apartment. When i move out, i hand the new keys to the owner. That way i make sure no old tenets or the owner can enter my apartment as they have no right to enter once its rented.
adenhoed 8y ago
In The Netherlands you have the right to replace the locks with your own locks, as long as you can re-install the original lock once you move out. How is that arranged in the US?
- cmg 8y ago
  Do you need to provide your landlord with a copy of the key to your new lock? In the US, it's standard for a rental agreement and/or state law to specify that the landlord can enter your property with 24 hours notice even if you're not there, or to enter immediately in case of an emergency.
  - adenhoed 8y ago
    No, if you replace it they don't have a key, and you don't have to give it to them.
  - brmgb 8y ago
    > In the US, it's standard for a rental agreement and/or state law to specify that the landlord can enter your property with 24 hours notice even if you're not there, or to enter immediately in case of an emergency. As a European, I find the idea extremely shocking. Here entering the residence of someone without their explicit consent is considered home invasion and can net you a year in jail and a fine of up to 15000 euros. It doesn't matter if you own the property as long as someone else lives their. It remains true if they are not paying. You will need the police and a court order if you want to enter.
    - lil_cain 8y ago
      Worth noting: this kind of rule is both normal, & legal in both IE & UK. The idea that this wasn't the case somewhere sounds weird (although nice!) to my European ears.
  - skrause 8y ago
    In Germany the landlord isn't even allowed to keep a copy of the key for the original lock, so obviously you don't have to give them a key of your own lock. All clauses in contracts that require you to give a key to the landlord are automatically void.
davidkuhta 8y ago
Why not just use a smart lock in conjunction with a normal keyed deadbolt? Then you can just use the combination of technologies at your discretion.
Faaak 8y ago
First thing I did when I moved into my flat was to change my locks. I bought various cylinders that open with the same key. Thus I can open my garage, my flat, and my other small spaces with the same key. Advantage too: the previous tenant wouldn't be able to access my home if they've kept the key. The landlord too. And if there's an unlikely urgence ? Well, just break the door (it's a cheap cardboard-y one)
- DKnoll 8y ago
  That probably violates the terms of your lease unfortunately.
  - Faaak 8y ago
    In Switzerland at least: no. It's considered the same as painting the walls: they have to be identical when you move out. In the meantime you do what you want. But frankly, I would do it even if it was forbidden, as long as the door wouldn't be reinforced.
    - DKnoll 8y ago
      Happy to hear that. Where I live (Ontario, Canada) it's not explicitly illegal but landlords are allowed to make the tenant not changing the locks a condition of their lease and most do because it is enforceable.
      - perl4ever 8y ago
        In the US where I live, I think I have noticed in more than one lease agreement something that says you may change the locks at your own expense if you want. I'm not sure how standard it is, but I've never seen anything that says you can't change them.
        DKnoll 8y ago
        It's odd that they make concessions like that in a lease agreement but that's great. Ontario generally favours tenants in legal matters but the locks thing bothers me a bit. I currently have an issue with my landlord and I know they have made illegal entry to my unit and others in my building (illegal meaning without 24hr notice for a valid reason or not because of an emergency) and I can't change my locks. My only option at the moment (because I have no proof to take to the Landlord and Tenant Board) is to place a camera in my apartment which I don't particularly like doing.
tpaschalis 8y ago
I really can't understand what some people are smoking out there. Is it's a push/lobby from companies? A need to have Orwellian control over the tenants? Misguided 'fellowkids' approach to appear 'hip' and 'embrace tech'..? Or just plain silliness? Hanlon's razor is failing me.
- noobiemcfoob 8y ago
  Then you just don't understand the viewpoint of a landlord. If I have to coordinate service to fix the waterheater or something but I live 3 towns over, it's a lot easier to give a technician a temporary password to the property in a set time window. /To do this requires a good relationship with your tenants and technicians
  - Faaak 8y ago
    You can also give the technician the property's renter's phone number and let themselves coordinate.
    - noobiemcfoob 8y ago
      You are greatly overestimating the amount of energy and time the average tenant will put into fixing anything in the property. I wish I could count on them to help in coordinating.
      - tpaschalis 8y ago
        Well, anecdote, but in most cases I know (South Europe) it's the tenants chasing behind the landlord to fix issues in their homes, and not vice versa :P Why wouldn't one want stuff on the property he's renting (and paying dearly for it) fixed?
        noobiemcfoob 8y ago
        You would think a tenant would be eager to get something fixed. I had a tenant with a broken water heater who waited 3 weeks to tell me. In the winter! /shrug I try not to judge
Simulacra 8y ago
No. In fact hell no. Maybe this will encourage more people to buy?

128 points by Lio 8y ago

Is it impossible to do this safely? Just like with my car, it would be really convenient when holding kids and a load of their stuff to not have to fish out the keys. I suppose there's the issue of your landlord locking you out if they're unhappy with something, but surely that is not purely a technological issue.

who-knows95 8y ago
it's more just the huge risk right? so many factors become part of the threat model, when you could stick to the physical lock, and really limit it. https://twitter.com/internetofshit?lang=en https://twitter.com/internetofshit?lang=en is a pretty good example. you could make a rfid chip reader part of your lock, but even that has weakness. http://www.astclock.com/astclocks-blog/advantages-of-rfid-door-locks/ http://www.astclock.com/astclocks-blog/advantages-of-rfid-do... tldr: limit your damn threat model/inconvenience.
- Thorrez 8y ago
  I don't think security of entry to the apartment is the main concern (because most locks can be picked fairly easily, and criminals force doors regardless of lock). I think privacy, network security, and availability are the bigger issues.
  - who-knows95 8y ago
    well, i do agree, the network and availability are my main issues. if a criminal is going to break you door, it's going to happen. but, i think people would be more suspicious of someone picking a door lock, rather then waving a Chip and the door allowing them access. i know, alot of hotels weren't surprised to learn their room doors were amazing weak. https://www.wired.co.uk/article/hotel-hack-digital-lock-door-system-fsecure-assa-abloy https://www.wired.co.uk/article/hotel-hack-digital-lock-door... if you want a good physical lock the ANSI Grading System is a good place to start.
Lazare 8y ago
In theory, yes, it's possible to do this safely. But offhand I can think of several horror stories about smart locks, and no good stories. The tech just seems absurdly immature at this point. And this product, in particular, is apparently known for glitching and not working, so...
- daxterspeed 8y ago
  On top of the software aspects many smart locks neglect the actual locking mechanism leaving the lock vulnerable to easy tricks like shimming. Smart locks also have to consider how they'll function without electricity. An exposed slot for a battery could let an attacker instantly fry the lock from the outside.
  - 300bps 8y ago
    An exposed slot for a battery could let an attacker instantly fry the lock from the outside. A long time ago I got drunk at my birthday party so my wife drove us back to the beach house we rented. She parked my car so that it was about five inches overhanging someone’s driveway. Their driveway wasn’t blocked but it was a dick move and they retaliated by shaving off candle wax into my car’s door locks. Fortunately I always used remote unlock but back then most people still used physical keys to unlock their car. People can mess or destroy any lock. There are legitimate concerns about electronic locks for sure but I don’t understand setting the bar so much higher for them than mechanical locks.
    - michaelt 8y ago
      I don’t understand setting the bar so much higher for them than mechanical locks. Based on the smart lock reviews I've seen on youtube channels that review locks, rejecting 98% of smart locks on the market doesn't require that you hold the smart locks to a higher standard than the mechanical locks. Because the reviews I've seen indicate almost all smart locks fall a long way short of the security of equally priced mechanical locks.
    - daxterspeed 8y ago
KingMachiavelli 8y ago
Key code locks are pretty convienient since you don't even need a phone yet aren't connected to any externel network and they allow a normal key to be used as a backup. A lot of them can be hooked up to the internet vie Z-wave or similar but they don't have to be.
- TarpitCarnivore 8y ago
  Even better are the ones that are keypads + smartlock. We'll probably be swapping over to one of the Yale locks which has a keypad & uses August's tech for the smart part.
detaro 8y ago
Just local RFID tokens without internet connection? If you use a system with properly secure tokens that's probably a relatively safe option. Same with key codes: internet management is not really needed for that. Of course access could be properly secured, but vendors have a really bad record of actually getting that right.
- johannes1234321 8y ago
  The tokens being secure is not enough. The system also has to check latency etc. to prevent repeater attacks. Imagine a scenario like that: You leave your car in a parking lot. One attacker follows you with a repeater. Once you're around the corner the second attacker approaches your car and opens it via the repeated radio signal and starts it. A while ago there had been a small debate on this topic, as attackers actually used such an approach to break into cars (sometimes even stealing them) https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can-steal-car/ https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...
  - smileysteve 8y ago
    A code repeater seems like a lot of work when standard tumbler locks are bypassed by a credit card, $10 lock pick set, a strong kick.
    - johannes1234321 8y ago
      According to that wired article the repeater is $10 as well and lockpicking needs a little practice and skill, using a repeater not. :)
  - tialaramex 8y ago
    You can sidestep this if the token needs to be explicitly activated. Unlike turning a key in a mechanical lock this needn't be something that requires dexterity, just any positive action e.g. pressing a button.
skywhopper 8y ago
Car locks are one thing. They are hackable, but only in a very targeted and location-specific manner, basically the same risk as a physical key. But this is a centrally controlled system in which your landlord and a third party you have no control over are monitoring your movements and can remotely unlock the door via an Internet-connected device. So it's remotely monitorable and hackable. And since there's no physical presence required to monitor or hack it, it's actually a much bigger risk than remote car locks. Also, cars are very different than homes. Typically we don't store truly valuable and irreplaceable items in our cars, unlike our homes. Typically we don't sleep in our cars, unlike our homes. You can easily see if someone is approaching your car, or trying to get in, when you are in it. Not necessarily the case with your home.

random_kris 8y ago

wow making such a drama on twitter because of this? I find it kinda funny to get triggered like that and having the need to make everything public.

thecatspaw 8y ago
I could imagine that you would not just want to stand by and do nothing if you suddenly have to move because the landlord just made your appartment very insecure
Lazare 8y ago
I think you're really underestimating how serious this is.
Thorrez 8y ago
If many people want to fight against something, making it public helps those people to find each other and organize. From some of the tweets, other people in similar situations have reached out to her.
thatfrenchguy 8y ago
You've never had a bad ex did you ?
ben_w 8y ago
> Some gems include the fact they don’t seem to realize the directly connected smarthub is an attack vector for the zwave smart devices, which they never patch. > And they can’t describe a patch SLA or what they’ll do in a couple years when their Zipato hubs aren’t updated anymore. > Been chatting with other security folks who brought this up and they were totally dismissed. Vendor couldn’t state they took basic measures like hashing and salting lock pins. If this was optional, fine, choose not to have it. But this isn’t optional, it is mandatory for all property managed by the same group, over the head of the landlord.
triggered 8y ago
Using the “triggered” buzzword to signal that this is another frivolous SJW anxiety, and yet this is not SJW related at all. This is a ligitimate security issue, since internet-enabled locks are never going to be secure enough to trust your life with, and even if one brand works well, most landlords will not be technically equipped to sort the differences out on there own, and will wind up deploying these locks before expert researchers can evaluate them. Working resonably-secure locks or not, what happens when the mothership goes down? When the domain gets hijacked? When wi-fi gets jammed? When wires get cut. Really sophisticated two stage attacks are being used on car security systems already. Step one, damage the internet link and wait. Step two, when the link is down the car’s security is defeated, and may be safely stolen. Oh look. Another buzzword. Get gaslighted.

paulie_a 8y ago

Why are they going full iot and smarthub with an app? My building uses rfid key fobs and it's great. Temporary ones can be made by calling the front desk.

thisismyaccoun7 8y ago
I believe I live in a complex owned by the same company as the Twitter user, and if so, I can answer that. The owners aren't installing it themselves but going through https://smartrent.com/ https://smartrent.com/. As you can see from their homepage, the benefits of the smart home features are aimed at owners/landlords/property managers primarily, with renters' benefits being secondary. Those landlord benefits come from online automation.

gambiting 8y ago

I mean......yes, it does look terrible and I would not want to have this installed in my house. But on the other hand....our landlord does have a physical copy of the key to our house. I consider this to be a good thing, not a bad thing though! Probably made even better by the fact that legally the landlord has to give tenants 24 hours notice if they want to gain entry(in the UK). They can't just come over whenever without telling me first.

maccard 8y ago
> our landlord does have a physical copy of the key to our house. I This should only be acceptable in the case where your landlord is also your property manager. If they're not, then your letting agent should have a copy of a key. On the 24 hours note, in 8 years of renting in the UK, I can only remember one instance where I was actually told 24 hours in advance. I was usually emailed at 5pm saying "hey, we have someone coming around for X tomorrow at 9:30, we will let them in". I told them no but they still came every time.
- gambiting 8y ago
  >> "hey, we have someone coming around for X tomorrow at 9:30, we will let them in". I told them no but they still came every time. Then they were breaking the law, and almost certainly the letting contract. The only question is whether you want to do anything about it or not(legally) - most people don't want to go and fight with their landlord over a repair happening with less than 24 hours notice. I only had to do this once - our landlord wanted some work carried out in less than 24 hours from telling me and I said ok, but you need to give us at least 24 hours notice, come back the next day - and they did.
- handzbagz 8y ago
  You can legally change the lock if you change it back when you move out.
  - pintxo 8y ago
    This: my current lock has been used in three different cities.

KeepFlying 8y ago

Horrifying. I hope she ends up winning a case on this. Even if it is just to get to move out early for free at least it's something. But wow. I'd be doing the same as her if this were forced on me. I love IoT things. But I draw the line at door locks. Physical security is already difficult enough. I'm not adding more attack vectors to that. Not to mention the data exfil that will most definitely happen with that system. I'm confident that even if the lock itself ends up being secure that the data that gets given to the landlord won't be protected at all.

fabian2k 8y ago

A "smart" lock without a fallback to a physical key. Uses a 4 digit code and locks you out after 5 tries. This is truly terrible even beyond the usual privacy and security concerns a smart lock introduces. And those concerns are far from trivial, this sounds like a privacy nightmare and also gives far too many people potentially access that shouldn't have.

talltimtom 8y ago
It also locks you out after that neighbor you don’t like intentionally types a wrong code five times, because you where playing loud Music yesterday until 21:00, which isn’t against the rules but he/she doesn’t like it. Extremely smart.
- regularfry 8y ago
  To be fair, a tube of superglue has a similar effect on a dumb lock.
  - BlackFly 8y ago
    Pushing buttons doesn't scream vandalism like inserting glue into a lock does. As a less vandalism like attack, consider when your drunk neighbours attempts to enter your apartment instead of their own. The security "feature" of a lock out is just an easily triggerable denial of service attack.
    - Nerdfest 8y ago
      I like doing it to corporate security folks after they try to dictate it in authentication systems. They usually seem to understand after it's done to them.
      - BlackFly 8y ago
        Oh, I like that approach. I will have to remember this "argument" against lock out.

nicolas_t 8y ago

Is there any secure smart lock? I would want one because I'm away 3 months a year and it would simplify renting my apartment on airbnb when I'm away (especially with the rent I pay in HK) but I'm also rather worried about the security implications. And from my brief research, a lot of vendors have very little documentations about security. I would obviously only consider one that has a fallback to an actual key.

justtopost 8y ago
Not that ai have seen. Check out 'the lockpicking laywer' on youtube for details on many models. He only focuses on physical security however.
smileysteve 8y ago
Define secure? A keyed tumbler lock can often be bypassed with a $10 kit and an hour's training via YouTube. Alternatively, without a frame reenforcement kit, a lock is bypassed with a strong kick. Finding a software hack is probably the least of your worries.
- 300bps 8y ago
  Technically savvy people can think of lots of ways to overcome technology. It’s easy to get hung up on the problems with something new while ignoring the problems of current systems. In addition to what you said, people often leave mechanical locks unlocked on at least one or more windows or doors. People often have easily broken glass on their doors. It’s commonly said that most locks are “courtesy locks” because they’re so easy to defeat. So I don’t understand many of the security concerns surrounding electronic locks. Privacy and failure concerns I can understand though.
- nicolas_t 8y ago
  That leads to a question I had recently, I know that some insurance will only reimburse in case of thefts if there's sign of a break-in. If someone lock-picks the lock, is there a trace of a break-in? Would such thefts be covered?

Shivetya 8y ago

Realtors and home renting companies use these near me. Signs that say "Let yourself in" and you can get a temporary code to go into a rental and such. From a privacy stand point there are many concerns but when renting or leasing you are already bound by laws requiring you to admin maintenance and even owners with sufficient notice. Notice timeliness is all based around the nature of the call. Plus on a safety side, elderly people could have locks opened for emergency persons by a central clearing system similar to how some home security systems are managed. In the long run, you opt out by living somewhere else or owning your own place. There are both pros and cons and we need to focus on both and not one or the other. edit: Another service/feature/etc I have seen lately is bundling standard utilities into the lease with surcharges for exceeding caps (electricity, gas, and water). This relieves the landlord of headaches and new residents from having issues getting services started

skywhopper 8y ago
Sure there are potential positives, but the current state of the art is not ready for this, and if you read the thread, it's clear this particular vendor is absolutely not handling the requisite security concerns in the right way. In any case, there's no good reason not to have a physical key for a fallback. What happens during a power outage and the Internet is down? How is this thing powered anyway? Batteries are a major problem. And again, if it's hardwired, that's also a risk.
Merad 8y ago
These aren't necessarily the same thing. When I was looking for a rental house about 6 months ago, essentially all of the homes I visited were set up with a "smart lockbox". You had to set up an account with a 3rd party service who required a picture of a photo id and a small fee ($5 for 30 days access, IIRC). The rental listings would ultimately link to the 3rd party service where you could schedule a visit to the house, then get a temporary code to access the key when you arrived. All of the homes still used traditional physical locks. I'm not a fan of "smart" devices, but think this was actually a great service as long as the home is unoccupied. As a tenant I was able to easily visit a dozen different homes in one day without having to spend hours on the phone scheduling visits with property managers.

scoot_718 8y ago

I'm shocked a landlord would willingly seek out this amount of legal liability. Home Contents Insurance companies take note - these guys are asking for it.

rlpb 8y ago

Clearly it wouldn't be reasonable to impose a lower standard of safety and security than a non-smart lock. I don't think landlords would attempt to argue that principle. The argument from them will be that smart locks do not regress security and safety. Given the widespread and well known security problems with IoT devices across the industry, I think it'd be reasonable to demand assurances on this. For example, an audit trail provided to the resident for every unlock event and who authorised it, an agreement to immediately revert indefinitely to a physical lock at the landlord's expense if a vulnerability is discovered, and daily financial compensation for every day that the landlord fails to act on these mitigations. Anything less than this I'd argue is a breach of contract, and any requirement that doesn't provide similar assurances would have to be by agreement by the tenant (ie. a new contract signed).

deleted 8y ago
[deleted]
privateSFacct 8y ago
Breach of contract? Huh? Most tenants do not have "audit trail" requirements in their contracts and their existing physical locks don't provide one. I always wonder if the folks making legal claims on hn actually practice law - the arguments are often nonsensical. Or maybe this type of logic is why law seems so backwards to folks
- rlpb 8y ago
  > Most tenants do not have "audit trail" requirements in their contracts and their existing physical locks don't provide one. No, but the contract was signed at a time when physical locks were the only norm and the security and safety characteristics of a physical lock can be considered to be implied by that contract. [For example a typical rental contract does not say "the landlord will maintain a working and suitable lock on the front door" but clearly a landlord would nevertheless be in breach of contract if the lock needed replacing due to wear and tear and the landlord refused to fix it] This wouldn't rule out installing a smart lock in the future, but only if the security and safety characteristics, as implied by the contract, are not regressed by doing so. A remote unlock facility wasn't agreed by the tenant, so it's reasonable to ask for an audit trail requirement in this case as previously the landlord (or their agent) would have had to be physically present, so their memory would serve as an audit trail. I think that the perspective that [the addition of] a remote unlock facility without an audit trail compromises the security and safety of a physical lock and thus breaks the implied contract is a perfectly reasonable argument, especially given the prevalence of general industry failure (known vulnerabilities in specific models) in this area.

mrweasel 8y ago

There's no a single IoT device available that I would want to install in my home, let alone a lock. I can understand the need for IoT device in industry, such as remote monitoring of device in the field. For home use I have yet to see a device that make any sense. IoT is at this point complete marketing hype, and very little practical application.

KozmoNau7 8y ago
I feel the same way, I explicitly avoid any device described as "smart". I don't need a "smart" blender or microwave or coffeemaker or refrigerator or anything else. The only two exceptions are my phone (hard to avoid) and my radiator thermostats. For the latter, they are connected to the internet and I can adjust temperature and put them in "holiday mode" from an app or web page. However the control box doesn't require any firewall holes or port openings, as far as I can tell it gets updates by sending a HTTP request to the same online portal where I can control my heating schedules. It communicates with the thermostats and window sensors on some kind of RF protocol similar to Z-wave, but if someone goes to the effort of hacking that just to mess with my heating, I would actually be a bit flattered. I probably wouldn't choose the internet-connected version again. Even though it is a lot easier to setup and manage, I think I would prefer the "dumb" standalone units. They're a bit more fiddly to setup initially, and you have to put each of them to holiday mode manually. But I would prefer to not have them connected to any kind of network. I used to be the type of person who wanted everything 100% connected 100% of the time. Over the last couple of years, I've taken a pretty hard turn in the opposite direction, I prefer to have everything as simple and standalone as possible.
apexalpha 8y ago
>For home use I have yet to see a device that make any sense. Slightly off-topic but I have a thermostat that only turns on when my phone (or me) is on the way home and it automatically turns it off when I leave my home. It saves me _considerable_ amount on my heating bill, especially since I'm not home on a regular schedule and often don't know until hours in advance.
- telesilla 8y ago

iwasakabukiman 8y ago

Can we change the title to “landlord”? I’m only seeing on person saying this is happening to them on Twitter and the title makes it sound extremely sensationalist.

wink 8y ago
In the thread it's stated that it's probably for a few thousand apartments if I'm not mistaken - not a single building/landlord. (Bit unsure about the exact categorization here, if the landlord is just outsourcing building management.)
thisismyaccoun7 8y ago
My complex's owners are doing this, and from the person's details on Twitter, it looks to be the same company. They own properties in 22 US states with 250,000 residents according to their website.

scotty79 8y ago

I recently got keyless car. Now I want something like that for my apartment door very much. No fumbling with the key. Just grab the handle and doors open.

HelloNurse 8y ago

What about connecting the lock to your network, collecting full network logs, and having the landlord arrested for hacking as soon as the wrong packet comes out of the device?

mnw21cam 8y ago
The landlady is having this forced onto her, so I would think the proper target would be the big org pushing the change.
Faaak 8y ago
I suppose that the lock only talks with a central server via an encrypted connection, so you wouldn't see any proof

calgoo 8y ago

I dont know how your system works in the US, but here in Spain, I change the lock when i move into a rented apartment. When i move out, i hand the new keys to the owner. That way i make sure no old tenets or the owner can enter my apartment as they have no right to enter once its rented.

adenhoed 8y ago

In The Netherlands you have the right to replace the locks with your own locks, as long as you can re-install the original lock once you move out. How is that arranged in the US?

cmg 8y ago
Do you need to provide your landlord with a copy of the key to your new lock? In the US, it's standard for a rental agreement and/or state law to specify that the landlord can enter your property with 24 hours notice even if you're not there, or to enter immediately in case of an emergency.
- adenhoed 8y ago
  No, if you replace it they don't have a key, and you don't have to give it to them.
- brmgb 8y ago
  > In the US, it's standard for a rental agreement and/or state law to specify that the landlord can enter your property with 24 hours notice even if you're not there, or to enter immediately in case of an emergency. As a European, I find the idea extremely shocking. Here entering the residence of someone without their explicit consent is considered home invasion and can net you a year in jail and a fine of up to 15000 euros. It doesn't matter if you own the property as long as someone else lives their. It remains true if they are not paying. You will need the police and a court order if you want to enter.
  - lil_cain 8y ago
    Worth noting: this kind of rule is both normal, & legal in both IE & UK. The idea that this wasn't the case somewhere sounds weird (although nice!) to my European ears.
- skrause 8y ago
  In Germany the landlord isn't even allowed to keep a copy of the key for the original lock, so obviously you don't have to give them a key of your own lock. All clauses in contracts that require you to give a key to the landlord are automatically void.

davidkuhta 8y ago

Why not just use a smart lock in conjunction with a normal keyed deadbolt? Then you can just use the combination of technologies at your discretion.

Faaak 8y ago

First thing I did when I moved into my flat was to change my locks. I bought various cylinders that open with the same key. Thus I can open my garage, my flat, and my other small spaces with the same key. Advantage too: the previous tenant wouldn't be able to access my home if they've kept the key. The landlord too. And if there's an unlikely urgence ? Well, just break the door (it's a cheap cardboard-y one)

DKnoll 8y ago
That probably violates the terms of your lease unfortunately.
- Faaak 8y ago
  In Switzerland at least: no. It's considered the same as painting the walls: they have to be identical when you move out. In the meantime you do what you want. But frankly, I would do it even if it was forbidden, as long as the door wouldn't be reinforced.
  - DKnoll 8y ago
    Happy to hear that. Where I live (Ontario, Canada) it's not explicitly illegal but landlords are allowed to make the tenant not changing the locks a condition of their lease and most do because it is enforceable.
    - perl4ever 8y ago
      In the US where I live, I think I have noticed in more than one lease agreement something that says you may change the locks at your own expense if you want. I'm not sure how standard it is, but I've never seen anything that says you can't change them.
      - DKnoll 8y ago
        It's odd that they make concessions like that in a lease agreement but that's great. Ontario generally favours tenants in legal matters but the locks thing bothers me a bit. I currently have an issue with my landlord and I know they have made illegal entry to my unit and others in my building (illegal meaning without 24hr notice for a valid reason or not because of an emergency) and I can't change my locks. My only option at the moment (because I have no proof to take to the Landlord and Tenant Board) is to place a camera in my apartment which I don't particularly like doing.

tpaschalis 8y ago

I really can't understand what some people are smoking out there. Is it's a push/lobby from companies? A need to have Orwellian control over the tenants? Misguided 'fellowkids' approach to appear 'hip' and 'embrace tech'..? Or just plain silliness? Hanlon's razor is failing me.

noobiemcfoob 8y ago
Then you just don't understand the viewpoint of a landlord. If I have to coordinate service to fix the waterheater or something but I live 3 towns over, it's a lot easier to give a technician a temporary password to the property in a set time window. /To do this requires a good relationship with your tenants and technicians
- Faaak 8y ago
  You can also give the technician the property's renter's phone number and let themselves coordinate.
  - noobiemcfoob 8y ago
    You are greatly overestimating the amount of energy and time the average tenant will put into fixing anything in the property. I wish I could count on them to help in coordinating.
    - tpaschalis 8y ago
      Well, anecdote, but in most cases I know (South Europe) it's the tenants chasing behind the landlord to fix issues in their homes, and not vice versa :P Why wouldn't one want stuff on the property he's renting (and paying dearly for it) fixed?
      - noobiemcfoob 8y ago
        You would think a tenant would be eager to get something fixed. I had a tenant with a broken water heater who waited 3 weeks to tell me. In the winter! /shrug I try not to judge

Simulacra 8y ago

No. In fact hell no. Maybe this will encourage more people to buy?