3 ms·

I use a "smart" lock, even with BT/wifi/GPS based automatic unlocking which seems to freak my fiancee out. I see it as stealing my phone is not different from s

by sandos 5y ago

I use a "smart" lock, even with BT/wifi/GPS based automatic unlocking which seems to freak my fiancee out. I see it as stealing my phone is not different from stealing my key. The more sinister ability is to unlock remotely via the "cloud" which I am still a bit shocked that it just seems to work, and no complaints AFAIK from insurance companies. I just happen to know that locks aren't really a deterrent if you really want to get inside a house.... On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home.

michaelt 5y ago
> On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home. The threat isn't a competent hacker targeting you directly. The threat is a competent hacker targeting the lock's vendor, getting their whole database, then selling address, entry code and occupancy times for $20 per home on the darknet.
- djrogers 5y ago
  > then selling address, entry code and occupancy times What locks are you referring to where locally configured entry codes are stored in a cloud DB? That's not the case for any of the ones I've installed.
  - InitialLastName 5y ago
    That you are savvy enough to know this is a suggestion that "locks you've installed" might not be a general sample.
- sdoering 5y ago
  It boils down to assessing the threat level and the risk level. Threat: Hacker owning vendor and selling info on darknet Threat likelyhood: 1% Risk: All valuables being stolen. Risk value: High if you keep a few kilograms of gold in your home. But basically depends on your possessions. When we were burglared while sleeping a few years back the perp entered through a window. It was the last window not switched to a new one more secure. It took him around 15 seconds to enter. He left with the DSLR, a TV, clothes, a few valuables lying around and my SO's purse. Additionally, because traditionally her car keys were by the door on ground level he could grab them and put everything into her car and leave. Nowadays our purses and keys never stay downstairs when we go to sleep. I think the risk profile for traditional break ins is way higher than the risk from a smart lock (not that we have any).
- rootusrootus 5y ago
  Schlage doesn't know where I live, though, nor do they get any status updates from my home assistant. It isn't software that is the problem you're referring to, it's involving a third party unnecessarily.
  - michaelt 5y ago
    Maybe for your smart lock - but sandos has "GPS based automatic unlocking" so his lock vendor probably knows exactly where he lives.
    - djrogers 5y ago
      That doesn't require your lock vendor to know anything about your location. Homekit for example can do this with your bridge doing the work, and any cloud-required data being e2e encrypted.
- bradstewart 5y ago
  But then what? Somebody still has to take the risk of actually burgling your house, getting passed the dog, alarm systems, lights, neighbors, etc. And if they're going to do that, it's quite likely easier to pop a window lock than it is to buy a darknet database of API keys.
krageon 5y ago
> I am not going to be targeted by [...] This reminds me strongly of an ex-employer of mine, whose response to a security vulnerability was inevitably "our customers won't do that". It's one thing to have a threat model, it is quite another to dismiss low-hanging fruit (and trust me, whatever "smart" lock you have is very low-hanging) as not a big concern.

by sandos 5y ago

michaelt 5y ago

> On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home. The threat isn't a competent hacker targeting you directly. The threat is a competent hacker targeting the lock's vendor, getting their whole database, then selling address, entry code and occupancy times for $20 per home on the darknet.

djrogers 5y ago
> then selling address, entry code and occupancy times What locks are you referring to where locally configured entry codes are stored in a cloud DB? That's not the case for any of the ones I've installed.
- InitialLastName 5y ago
  That you are savvy enough to know this is a suggestion that "locks you've installed" might not be a general sample.
sdoering 5y ago
It boils down to assessing the threat level and the risk level. Threat: Hacker owning vendor and selling info on darknet Threat likelyhood: 1% Risk: All valuables being stolen. Risk value: High if you keep a few kilograms of gold in your home. But basically depends on your possessions. When we were burglared while sleeping a few years back the perp entered through a window. It was the last window not switched to a new one more secure. It took him around 15 seconds to enter. He left with the DSLR, a TV, clothes, a few valuables lying around and my SO's purse. Additionally, because traditionally her car keys were by the door on ground level he could grab them and put everything into her car and leave. Nowadays our purses and keys never stay downstairs when we go to sleep. I think the risk profile for traditional break ins is way higher than the risk from a smart lock (not that we have any).
rootusrootus 5y ago
Schlage doesn't know where I live, though, nor do they get any status updates from my home assistant. It isn't software that is the problem you're referring to, it's involving a third party unnecessarily.
- michaelt 5y ago
  Maybe for your smart lock - but sandos has "GPS based automatic unlocking" so his lock vendor probably knows exactly where he lives.
  - djrogers 5y ago
    That doesn't require your lock vendor to know anything about your location. Homekit for example can do this with your bridge doing the work, and any cloud-required data being e2e encrypted.
bradstewart 5y ago
But then what? Somebody still has to take the risk of actually burgling your house, getting passed the dog, alarm systems, lights, neighbors, etc. And if they're going to do that, it's quite likely easier to pop a window lock than it is to buy a darknet database of API keys.

krageon 5y ago

> I am not going to be targeted by [...] This reminds me strongly of an ex-employer of mine, whose response to a security vulnerability was inevitably "our customers won't do that". It's one thing to have a threat model, it is quite another to dismiss low-hanging fruit (and trust me, whatever "smart" lock you have is very low-hanging) as not a big concern.