4 ms·

Losing access to a lock is bad stuff. I went with a smart lock that has a physical key. The article says don't buy a smart-lock, but the convenience of having

Losing access to a lock is bad stuff. I went with a smart lock that has a physical key. The article says don't buy a smart-lock, but the convenience of having one-time access codes, scheduled access, delivery access, and linked to a security camera make the downsides (increased attack vectors) something I'm willing to live with.

berbec 7y ago
And we, on HN, can make an informed decision about that calculated risk. The general public just sees "Encrypted Android App with Smart Unlock" and thinks they are safe.
- balls187 7y ago
  Is that any different than virtually any other cyber security issue--the general public is not well equipped to do Risk Mitigation compared to more savvy individuals?
  - mikeash 7y ago
    Or any other physical security issue? There are massive differences in the security of standard physical locks. How much does the average person know about that? How many people are buying locks based on an informed decision about its pick resistance and physical strength, versus buying whatever looks nice?
  - wlesieutre 7y ago
    It's a problem with the way technology scales. Previously difficult things become cheap to do at massive scales, and companies make tons of money doing it. But it also make vulnerabilities scale in the same way - exfiltrating 150,000,000 SSNs isn't much harder than 150 - and the penalties for security lapses don't scale anything like the profits that operating at these scales does. What's the solution to that? Bigger penalties so that companies prioritize security? Require companies handling data and devices to carry insurance against huge hacks? I don't know, but we need to get somewhere better than "Ignore it because consumers generally don't understand the risks and apology letters are cheap." The one good thing about IoT locks compared to other internet security issues is that you need physical access to do anything with it. The script kiddies spamming SSH authentication attempts at every webserver from somewhere on the other side of an ocean can't break in to your house with this. Other IoT devices like security cameras are still a concern though; a vulnerability in those could scoop up a lot of private videos.
- banana_giraffe 7y ago
  Or they see a Master Lock advertised as "4-pin cylinder for added pick resistance" and think it's harder than "trivial" to pick.
hestipod 7y ago
Tangentially related tip: Inside most modern car keyfobs there is an "emergency" physical key...or should be (recently saw one where the space was empty as the dealer had failed to include it) It's not marked or obvious from the outside of most I have seen and some prying in some innocuous looking seam will be needed. One of those things that seems obvious once you know it but may not have run across.
- myself248 7y ago
  In my experience, there's usually a subtle release mechanism or button that you need to squeeze and the physical key will slide out readily. On some of mine, the physical key is also the pry-tool used to open the body of the fob for battery changing. :) On my Toyota, this mechanical key can be used to lock the doors while the engine is running (pitstop mode), which is otherwise not possible. On my friend's Mercedes, it does not respond to the mechanical key (wait, what?) while the engine is running.

berbec 7y ago

And we, on HN, can make an informed decision about that calculated risk. The general public just sees "Encrypted Android App with Smart Unlock" and thinks they are safe.

balls187 7y ago
Is that any different than virtually any other cyber security issue--the general public is not well equipped to do Risk Mitigation compared to more savvy individuals?
- mikeash 7y ago
  Or any other physical security issue? There are massive differences in the security of standard physical locks. How much does the average person know about that? How many people are buying locks based on an informed decision about its pick resistance and physical strength, versus buying whatever looks nice?
- wlesieutre 7y ago
  It's a problem with the way technology scales. Previously difficult things become cheap to do at massive scales, and companies make tons of money doing it. But it also make vulnerabilities scale in the same way - exfiltrating 150,000,000 SSNs isn't much harder than 150 - and the penalties for security lapses don't scale anything like the profits that operating at these scales does. What's the solution to that? Bigger penalties so that companies prioritize security? Require companies handling data and devices to carry insurance against huge hacks? I don't know, but we need to get somewhere better than "Ignore it because consumers generally don't understand the risks and apology letters are cheap." The one good thing about IoT locks compared to other internet security issues is that you need physical access to do anything with it. The script kiddies spamming SSH authentication attempts at every webserver from somewhere on the other side of an ocean can't break in to your house with this. Other IoT devices like security cameras are still a concern though; a vulnerability in those could scoop up a lot of private videos.
banana_giraffe 7y ago
Or they see a Master Lock advertised as "4-pin cylinder for added pick resistance" and think it's harder than "trivial" to pick.

hestipod 7y ago

Tangentially related tip: Inside most modern car keyfobs there is an "emergency" physical key...or should be (recently saw one where the space was empty as the dealer had failed to include it) It's not marked or obvious from the outside of most I have seen and some prying in some innocuous looking seam will be needed. One of those things that seems obvious once you know it but may not have run across.

myself248 7y ago
In my experience, there's usually a subtle release mechanism or button that you need to squeeze and the physical key will slide out readily. On some of mine, the physical key is also the pry-tool used to open the body of the fob for battery changing. :) On my Toyota, this mechanical key can be used to lock the doors while the engine is running (pitstop mode), which is otherwise not possible. On my friend's Mercedes, it does not respond to the mechanical key (wait, what?) while the engine is running.