8 ms·

I presume the Alexa Argument ist against the service and not against automation. Running your whole life on self hosted home automation is Stil awesome and the

by theK 5y ago

I presume the Alexa Argument ist against the service and not against automation. Running your whole life on self hosted home automation is Stil awesome and the way to go. Just ensure that data never leaves your home premises and you have enough resiliency.

krageon 5y ago
I would say trusting any kind of software with door locks(!) is a terrible idea. Yes, if you use home automation you should self host. No, if you secure your home you should not needlessly expand the attack surface.
- sandos 5y ago
  I use a "smart" lock, even with BT/wifi/GPS based automatic unlocking which seems to freak my fiancee out. I see it as stealing my phone is not different from stealing my key. The more sinister ability is to unlock remotely via the "cloud" which I am still a bit shocked that it just seems to work, and no complaints AFAIK from insurance companies. I just happen to know that locks aren't really a deterrent if you really want to get inside a house.... On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home.
  - michaelt 5y ago
    > On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home. The threat isn't a competent hacker targeting you directly. The threat is a competent hacker targeting the lock's vendor, getting their whole database, then selling address, entry code and occupancy times for $20 per home on the darknet.
    - djrogers 5y ago
      > then selling address, entry code and occupancy times What locks are you referring to where locally configured entry codes are stored in a cloud DB? That's not the case for any of the ones I've installed.
      - InitialLastName 5y ago
        That you are savvy enough to know this is a suggestion that "locks you've installed" might not be a general sample.
    - sdoering 5y ago
      It boils down to assessing the threat level and the risk level. Threat: Hacker owning vendor and selling info on darknet Threat likelyhood: 1% Risk: All valuables being stolen. Risk value: High if you keep a few kilograms of gold in your home. But basically depends on your possessions. When we were burglared while sleeping a few years back the perp entered through a window. It was the last window not switched to a new one more secure. It took him around 15 seconds to enter. He left with the DSLR, a TV, clothes, a few valuables lying around and my SO's purse. Additionally, because traditionally her car keys were by the door on ground level he could grab them and put everything into her car and leave. Nowadays our purses and keys never stay downstairs when we go to sleep. I think the risk profile for traditional break ins is way higher than the risk from a smart lock (not that we have any).
    - rootusrootus 5y ago
      Schlage doesn't know where I live, though, nor do they get any status updates from my home assistant. It isn't software that is the problem you're referring to, it's involving a third party unnecessarily.
      - michaelt 5y ago
        Maybe for your smart lock - but sandos has "GPS based automatic unlocking" so his lock vendor probably knows exactly where he lives.
        djrogers 5y ago
        That doesn't require your lock vendor to know anything about your location. Homekit for example can do this with your bridge doing the work, and any cloud-required data being e2e encrypted.
    - bradstewart 5y ago
      But then what? Somebody still has to take the risk of actually burgling your house, getting passed the dog, alarm systems, lights, neighbors, etc. And if they're going to do that, it's quite likely easier to pop a window lock than it is to buy a darknet database of API keys.
  - krageon 5y ago
    > I am not going to be targeted by [...] This reminds me strongly of an ex-employer of mine, whose response to a security vulnerability was inevitably "our customers won't do that". It's one thing to have a threat model, it is quite another to dismiss low-hanging fruit (and trust me, whatever "smart" lock you have is very low-hanging) as not a big concern.
- Joeri 5y ago
  Unless you have a door specifically designed to withstand burglary a crowbar will always be an easier door hack than figuring out a backdoor to your automation. There is no perfect security, only risk profiles. I would argue the risk profile of door lock automation is low enough not to be worthy of concern in most cases.
  - account42 5y ago
    > Unless you have a door specifically designed to withstand burglary a crowbar will always be an easier door hack than figuring out a backdoor to your automation. If your home is targeted specifically, yes. However, if a group hacks a cloud lock provider and then hits several homes using that without having to do something that looks supicious like physically breaking the door then it could be a lot safter and thus profitable for them.
    - mrep 5y ago
      And so they what, rob a few houses which statistically probably won't be yours before their hack gets discovered? Sounds like way more effort than just breaking the door or picking the lock.
- zoltar 5y ago
  You should probably update your threat model.
  - krageon 5y ago
    Why, is it out of date? Am I missing the latest security updates?
    - rootusrootus 5y ago
      My generic answer (not being the guy who replied to you) is to look at probabilities. AFAIK in most places theft from homes is opportunistic. Garage doors left open, for example, is extremely common. Thieves just drive around looking for them, it's such a reliable occurrence. Other times, they just try the door and walk in if it's unlocked and they think nobody is home. I.e. automating your door locks may very well increase your actual security rather than reduce it, if it causes your doors to be locked more often than you'd remember otherwise.
- rootusrootus 5y ago
  In what little experience I have with burglars, they aren't exactly the type who will be hacking your smart locks to get into your house. They're just going to break the door or window. I like being able to check the status of my door locks remotely, and lock them if necessary. I like being able to make sure all locks and garage doors are secure automatically before bedtime. I'm not at all worried about someone sitting out in front of my house hacking the Z-Wave lock. By the time they figured it out, the neighbors will have already called the police anyway. Connecting all my door locks (and garage doors too) to HA has measurably increased the security of my home.
grujicd 5y ago
My problem was not with Alexa specifically, it was a general feeling of "if software controls both locks and blinds it can lock you not only outside but inside as well". Of course I was immediatelly told that there's a physical workaoround in case anything goes wrong. I cited this example not as something that is objectively bad, but as something subjective, more about my gut reaction. Funny thing is both my friend and I have electrical engineering education. I went to build software for a living, he more or less moved to sales/management. His job is to hype tech. My job is to make the saussage. There's a popular meme which I heard some time after the anecdote above: Tech enthusiasts: My entire house is smart. Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don't recognize.

by theK 5y ago

krageon 5y ago

I would say trusting any kind of software with door locks(!) is a terrible idea. Yes, if you use home automation you should self host. No, if you secure your home you should not needlessly expand the attack surface.

sandos 5y ago
I use a "smart" lock, even with BT/wifi/GPS based automatic unlocking which seems to freak my fiancee out. I see it as stealing my phone is not different from stealing my key. The more sinister ability is to unlock remotely via the "cloud" which I am still a bit shocked that it just seems to work, and no complaints AFAIK from insurance companies. I just happen to know that locks aren't really a deterrent if you really want to get inside a house.... On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home.
- michaelt 5y ago
  > On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home. The threat isn't a competent hacker targeting you directly. The threat is a competent hacker targeting the lock's vendor, getting their whole database, then selling address, entry code and occupancy times for $20 per home on the darknet.
  - djrogers 5y ago
    > then selling address, entry code and occupancy times What locks are you referring to where locally configured entry codes are stored in a cloud DB? That's not the case for any of the ones I've installed.
    - InitialLastName 5y ago
      That you are savvy enough to know this is a suggestion that "locks you've installed" might not be a general sample.
  - sdoering 5y ago
    It boils down to assessing the threat level and the risk level. Threat: Hacker owning vendor and selling info on darknet Threat likelyhood: 1% Risk: All valuables being stolen. Risk value: High if you keep a few kilograms of gold in your home. But basically depends on your possessions. When we were burglared while sleeping a few years back the perp entered through a window. It was the last window not switched to a new one more secure. It took him around 15 seconds to enter. He left with the DSLR, a TV, clothes, a few valuables lying around and my SO's purse. Additionally, because traditionally her car keys were by the door on ground level he could grab them and put everything into her car and leave. Nowadays our purses and keys never stay downstairs when we go to sleep. I think the risk profile for traditional break ins is way higher than the risk from a smart lock (not that we have any).
  - rootusrootus 5y ago
    Schlage doesn't know where I live, though, nor do they get any status updates from my home assistant. It isn't software that is the problem you're referring to, it's involving a third party unnecessarily.
    - michaelt 5y ago
      Maybe for your smart lock - but sandos has "GPS based automatic unlocking" so his lock vendor probably knows exactly where he lives.
      - djrogers 5y ago
        That doesn't require your lock vendor to know anything about your location. Homekit for example can do this with your bridge doing the work, and any cloud-required data being e2e encrypted.
  - bradstewart 5y ago
    But then what? Somebody still has to take the risk of actually burgling your house, getting passed the dog, alarm systems, lights, neighbors, etc. And if they're going to do that, it's quite likely easier to pop a window lock than it is to buy a darknet database of API keys.
- krageon 5y ago
  > I am not going to be targeted by [...] This reminds me strongly of an ex-employer of mine, whose response to a security vulnerability was inevitably "our customers won't do that". It's one thing to have a threat model, it is quite another to dismiss low-hanging fruit (and trust me, whatever "smart" lock you have is very low-hanging) as not a big concern.
Joeri 5y ago
Unless you have a door specifically designed to withstand burglary a crowbar will always be an easier door hack than figuring out a backdoor to your automation. There is no perfect security, only risk profiles. I would argue the risk profile of door lock automation is low enough not to be worthy of concern in most cases.
- account42 5y ago
  > Unless you have a door specifically designed to withstand burglary a crowbar will always be an easier door hack than figuring out a backdoor to your automation. If your home is targeted specifically, yes. However, if a group hacks a cloud lock provider and then hits several homes using that without having to do something that looks supicious like physically breaking the door then it could be a lot safter and thus profitable for them.
  - mrep 5y ago
    And so they what, rob a few houses which statistically probably won't be yours before their hack gets discovered? Sounds like way more effort than just breaking the door or picking the lock.
zoltar 5y ago
You should probably update your threat model.
- krageon 5y ago
  Why, is it out of date? Am I missing the latest security updates?
  - rootusrootus 5y ago
    My generic answer (not being the guy who replied to you) is to look at probabilities. AFAIK in most places theft from homes is opportunistic. Garage doors left open, for example, is extremely common. Thieves just drive around looking for them, it's such a reliable occurrence. Other times, they just try the door and walk in if it's unlocked and they think nobody is home. I.e. automating your door locks may very well increase your actual security rather than reduce it, if it causes your doors to be locked more often than you'd remember otherwise.
rootusrootus 5y ago
In what little experience I have with burglars, they aren't exactly the type who will be hacking your smart locks to get into your house. They're just going to break the door or window. I like being able to check the status of my door locks remotely, and lock them if necessary. I like being able to make sure all locks and garage doors are secure automatically before bedtime. I'm not at all worried about someone sitting out in front of my house hacking the Z-Wave lock. By the time they figured it out, the neighbors will have already called the police anyway. Connecting all my door locks (and garage doors too) to HA has measurably increased the security of my home.

grujicd 5y ago

My problem was not with Alexa specifically, it was a general feeling of "if software controls both locks and blinds it can lock you not only outside but inside as well". Of course I was immediatelly told that there's a physical workaoround in case anything goes wrong. I cited this example not as something that is objectively bad, but as something subjective, more about my gut reaction. Funny thing is both my friend and I have electrical engineering education. I went to build software for a living, he more or less moved to sales/management. His job is to hype tech. My job is to make the saussage. There's a popular meme which I heard some time after the anecdote above: Tech enthusiasts: My entire house is smart. Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don't recognize.