8 ms·
> What I like about this lock is that ... But, most importantly, it can be locked/unlocked with a tap in Home Assistant. This is the line I am not willing to c
by buro9 6y ago
> What I like about this lock is that ... But, most importantly, it can be locked/unlocked with a tap in Home Assistant.
This is the line I am not willing to cross.
Do I believe that the security of Home Assistant and the plugins that surface this to web/mobile interfaces is such that I'd risk the physical security of my home and possessions to it?
I love the Pi doorbell project, and could eventually be onboard with a home security company producing a smart lock I would consider... but enabling a lock via Home Assistant to grant access to the house, disable alarms, etc (assuming HA scripts like "when the door is unlocked disable alarm to prevent false positive", etc)... I suspect my insurance company would consider this an act of me leaving the door open and granting access to people who later stole stuff and that they wouldn't pay out.
- unclekev 6y agoThe thought of - if the 'bad guys' get access to a single machine, they can potentially control every security related device in my house makes me very anxious.
- jmnicolas 6y agoI don't know about your average bad guy, but here in France they smash your window with a rock found nearby then take everything they can in 5 minutes.
- onion2k 6y agoIf you ever have the opportunity try to smash a modern double-glazed window with a rock. Stand well back though because the rock will just bounce back at you.
- karlshea 6y agoLarge parts of Minneapolis beg to differ.
- kwhitefoot 6y agoYou just need to be slightly smarter than the average opportunistic thief. Hit the glass very hard in the corner where it is held most firmly so that you get a large force distributed over a small area, that is the largest stress. The same thing goes for smashing a car window. I have a small spring loaded device on my keyring for exactly this purpose [1]. A slightly smarter thief might carry a hammer specifically designed to break double glazing [2]. Mind you carrying that in the UK could count as 'going equipped' if you don't have a plausible excuse. Otherwise just use a heavy pointed rock in the corner of the window. But of course most burglars don't break windows, they take advantage of open windows, doors than can be forced, sliding doors that can simply be lifted out of the track, and other flaws in building security. [1] Like this: https://www.smartasaker.no/no/artiklar/resqme-belteskjarer-amp-vindusknuser.html https://www.smartasaker.no/no/artiklar/resqme-belteskjarer-a... [2] For instance: https://www.amazon.co.uk/dp/B00EFZC62Q https://www.amazon.co.uk/dp/B00EFZC62Q
- mytailorisrich 6y agoWhat I've noticed is that in France most people, including in flats, have extremely strong and secure doors and locks while here in the UK most people have simple doors with simple barrel locks. It seems massively easier to break into a home this side of the channel.
- speedgoose 6y agoThey more likely use something like a spark plug to break the window.
- lllr_finger 6y agoFor those wondering how a spark plug would work: https://en.wikipedia.org/wiki/Ninja_rocks https://en.wikipedia.org/wiki/Ninja_rocks
- dec0dedab0de 6y agoIn my area they learn your schedule, break in through the back door with a crowbar while you're walking the dog, and have a friend pull a moving van into your driveway. At least that's what one very successful group did a while back before they got themselves caught.
- zrail 6y agoA) what bad guys? Best to try to be specific when you’re threat modeling. B) Does your home have easier ingress methods that don’t require finding the server, hacking into it, and hitting the correct button? For example, a first floor window?
- deleted 6y ago[deleted]
- Kudos 6y agoB) being true doesn't make the cautiousness around home smart device security less important. Do you want to elaborate on where you were planning to go on this?
- zrail 6y agoI guess my point is to be realistic with your threat modeling. Sure don’t advertise the wifi password that grants access to your smart lock, but also realize that the vast majority of crime is that of opportunity. Unless you think you are being targeted by sophisticated people who want more than your cash and tv, worrying about the security of your IoT devices is probably misplaced.
- Kudos 6y agoI agree that most crime is crime of opportunity. I'd categorise automated bots sniffing for open ipcams, or other devices as that too. I consider my privacy is as valuable as my possessions :)
- outsomnia 6y agoYeah... great idea to hang just such a machine with credentials on an SD card in a plastic box outside your front door. I need a video doorbell with my own remote storage. but the camera sensor part and the button needs to be the only thing on the untrusted side of the door.
- hsbauauvhabzb 6y agoI’d probably trust HASS more than most of the alternatives. I was looking the other night and it’s basically Samsung or brand names I’ve never heard of before.
- d_theorist 6y agoNot immediately obvious to me whether such a thing is more or less secure than your typical consumer door lock for whatever threat model you are concerned about.
- hunter2_ 6y agoFor neighborhood burglars who pick on you for conventional reasons, it will reduce security by an infinitesimal amount because they probably won't think "oh a smart lock, let's hack that for a quieter entry." For hackers anywhere who don't mind traveling, perhaps a few would think "hey we already got the door unlocked, maybe we can burgle the place, too." Far fetched, but who knows.
- fhars 6y agoThe thread model as stated is "the insurance company notices there is something nonstandard about the lock and denies all claims."
- darkwater 6y agoDoes anybody actually expose their Home Assistant installation directly on the Internet these days? Just use WireGuard!
- SparkyMcUnicorn 6y agoThis. And if someone has full access to my internal network, then I've got bigger problems than my TV being stolen.
- oarsinsync 6y agoThis is a really interesting view. If someone has broken into my home, I have much bigger problems than if they've managed to break into my wifi or VPN gateway from the internet.
- sgt 6y agoHe probably has a cache of Bitcoins
- twicetwice 6y agoI think the idea was that if an attacker sophisticated enough to overcome your reasonable defenses protecting your local network and potentially hack your Home Assistant installation or whatever else, then they're probably sophisticated enough to do something much more damaging in the long term than unlock your front door and steal your TV or whatever—eg hack your laptop/NAS/etc and clear out your bank account or steal your identity or similar. Though I just realized that I'm privileged enough to live in an area with a low violent crime rate, so physical violence isn't part of my threat model... if someone has broken into your home and you are home at the same time, you're right, the security of your local network is probably the least of your concerns.
- sgt 6y agoNginx proxy exposed on ports 80 and 443, passing requests to HA running internally. What is wrong with that?
- pqs 6y agoIn terms of security, thinking that your door lock will protect you is not a good strategy. There are many ways in which your door lock can be opened or broken. If it is a house, there are many other alternatives, like breaking through a window. I don't think that this smart lock, if well configured, makes you any more less secure.
- leoedin 6y agoIf someone has to break a window to get in, you've got clear evidence of a break in. Insurance will be easier, the police will take you more seriously. It also deters casual thieves who might try the door. Sure, any lock is more deterrent than a fortress, but that doesn't mean you shouldn't bother.
- FractalParadigm 6y agoI think the difference the OP is pointing out is that, insurance can look at a broken door or a broken window and say "yep, this is where the person entered the property." Whereas they'll look at a home-built door lock that was hacked/bypassed and deny any claim, on the basis it "wasn't secure enough" - similar in vein to just leaving your front door unlocked, you won't get any sort of payout
- skohan 6y agoI think @pqs' point is a valid one though: circumventing a home lock by compromising a home automation system's security is surely a higher bar for thief to overcome than breaking through a window, so it's a bit funny for the former to be categorized as a failure on the part of the homeowner, while nobody is expecting everyone to install bulletproof metal shutters.
- rebuilder 6y agoSure, breaking a window is easier, but that triggers an alarm and arms the home defense system. If, OTOH, the thief subverts the home automation system, not only can they open the door and disable the cameras, they can instruct the system to pipe the anti-intruder knockout gas into the biolab/hackerspace where you are burning the midlight oil, working on your revolutionary chimpanzee/cheetah hybrid pizza delivery servant. The thief is then able sneak in undetected and steal your zygotes and tissue samples. Worst-case scenario, they'll take a kidney as well. Yours, I mean. This is why it's so important to have physical safeguards in place, like the mechanical stops that keep the home defense cannon in the foyer from being aimed away from the front door. And obviously bulletproof metal shutters.
- raxxorrax 6y agoWith a local installation I see no problem. It gets weird if your internet fails and you door doesn't open anymore. That said, you are probably right about insurance if you installed anything yourself without mechanisms to ensure the door is closed in all failure cases. edit: That other insurance might be less happy with that in case of fire emergencies of course.