Cybersecurity tech worker here, and same. Even with the local server though, the one smart thing that I absolutely don’t fucks with is exterior door locks. I got one that does PIN entry, but absolutely no wireless or Bluetooth or anything. Other than that let’s fucking go it’s 2024 I can’t be bothered to open my window shades with my hands like I’m living in the 1800s on a farm in the fucking prairie or some shit. They open on a schedule, synced at a slightly earlier offset to my wake up alarm.
Eh if they are savvy enough to unlock my door they are smart enough to break my window. Also if they can unlock my door I still have zwave open/close sensors that will trigger the alarm so I will take the convince of smart locks over non smart any day. I can keep the wandering bums out but remotely let family members in without having to give out my code or keys.
That’s fair. I can store like 20 codes or something, so I just keep one extra in there then rotate it after whoever I had to give it to is done with needing it.
I live on a really busy street in a city, so I’m really not worried about someone breaking a window to get inside. Sure there’s a nonzero chance a methie might smash a window, but around here it’s mostly just testing car door handles and maybe smashing the car window if there’s a visible wallet or pill bottle or something.
Walking up to my door and doing a replay attack, or sending a master password to the lock takes seconds and doesn’t look any more suspicious than a resident entering the house. This talk is from 2016, but I doubt things have gotten significantly better, and I don’t want to be replacing my door lock, or even worrying about updating firmware, whenever something like this is found (Picking BLE Locks - Anthony Rose & Ben Ramsey).
But yeah, I’m not saying anyone’s an idiot for using a smart lock or anything, odds are it will never matter either way.
There are a lot of zwave s2 locks out there. No Bluetooth at all.
128-bit AES isn’t amazing, but it’s more solid than bluetooth and most hardware locks.
Most locks, including deadbolts, can be picked or bumped in seconds. The physical lock is the weakest point. You can get zwave s2 smart locks with just pin pads, no physical key. That’s probably the most secure option.
CVE-2020-9060
Z-Wave devices based on Silicon Labs 500 series chipsets using S2 are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.
Oof. Could you imagine having a vindictive neighbor who is mad at you over some dumb shit you have no idea about, then then DoS’ing your lock that has no physical key?
Again probably as close to zero as a non zero chance can be of actually happening, but idk just give me a key and some buttons for when I have bags and shit.
Also, if i decided to go in to home invasions I’d rather just carry around a phone or a raspberry pi or something and pop smart locks than carry around a snap gun.
Everything you’re saying is right though, there’s always a trade off when it comes to security.
Always have a backup trigger. A open/close sensor is hard to beat. They would have to know where it is and have access to it to bypass it. And for good measure a shock sensor to know if someone is trying to break it down.
Dream: I will slowly wake up to gently increasing morning sun
Reality: my alarm clock sound is now just the buzzing and whirring of a motor that is starting to open my blinds. Just as I fall back asleep the whirring noise starts again to increase the light level.
Like you want to have a dumb lock but a smart sensor that tells you if the deadbolt is locked or open?
I remember reading some blog somewhere about a person who rigged up a sensor to alert them if their mailbox had been opened or not, you could probably design something to do similar. Idk maybe a magnetic thing to detect the bolt itself, or something to detect on the position of the latch on the interior of the door?
Found this after a quick search, sorry for it being Reddit and the video of the working solution being uploaded to gfycat.
That’s definitely one way to approach it. You wouldn’t have to attach something to the door that way, but you’d have to mess with wires external to the device.
I think they’re saying they wish they could afford PDLC film for all their windows. If you can DIY PDLC film you probably have a 3D printer the size of a tractor trailer and are 3D printing yourself a new house or something just for for the fuck of it in the backyard of your estate.
Unless my client is fucking up and putting their post as a reply to the wrong comment (which is a real possibility), they replied to Telorand who was talking about PDLC film.
Here in Italy shutter covers are common, I have those and awnings, both can be connected to any sort of smart 2-way switch. I use BTicino for the shutters and Shelly 2PMs for the awnings
In the US, 95% of “smart” tech wants WiFi connection to a proprietary cloud and they will make breaking API changes and/or ban users for using 3rd party clients. Only phone apps with permission to see your contacts allowed!
That being said, you can usually find products that will work locally but it’s really difficult, and big-box stores almost never have anything Zigbee/Z-wave or even Matter enabled. It’s bleak.
Ew. Blinds really should be line of sight IMO. I don’t want anything related to my physical privacy living in the cloud (and that goes double for you, Ring).
Ikea sells ZigBee blinds that connect right up to any home automation hub. Pretty cheap too, in the $100-200 range for most windows.
I’m using several. Batteries are solid. I get a good 3 months with daily opening/closing. I only wish they had solar modules you could add in, but the battery tray design makes that unlikely.
Damn that sucks. I lived in an apartment and wound up rigging up an arduino to pull the chain on these three massive window shades in my apartment, they were seriously like 20 foot tall windows. This was back in 2015 or so, so I didn’t even bother trying to find anything off the shelf.
Yep fully agree on the exterior door locks. That is the one thing that should never be connected to anything even local servers. Also have to be careful with electronic locks in general. Some brands are terribly designed and can be bypassed in a stupidly easy way.
I’m more of a middle-ground person myself. I have Home Assistant fully self-hosted and using a secure cloudflare tunnel for external access. A few other self-hosted containers running other various things. Anything exposed to the internet requires a login. I always try to find stuff that integrates with HA, but I don’t go to the full length of finding stuff that doesn’t require the brand app to setup. I like the local control stuff if I can get it, because it usually works a lot better, but I won’t actively avoid every brand that connects to a cloud somewhere because that’s too much effort to avoid for me.
There’s a difference between recognizing the risks of “smart” tech and knowing the futility of avoiding it -or- even better having the skill to mitigate as much risk as possible.
Tech worker here. My house is largely smart, but it’s all controlled by a local server.
Cybersecurity tech worker here, and same. Even with the local server though, the one smart thing that I absolutely don’t fucks with is exterior door locks. I got one that does PIN entry, but absolutely no wireless or Bluetooth or anything. Other than that let’s fucking go it’s 2024 I can’t be bothered to open my window shades with my hands like I’m living in the 1800s on a farm in the fucking prairie or some shit. They open on a schedule, synced at a slightly earlier offset to my wake up alarm.
Eh if they are savvy enough to unlock my door they are smart enough to break my window. Also if they can unlock my door I still have zwave open/close sensors that will trigger the alarm so I will take the convince of smart locks over non smart any day. I can keep the wandering bums out but remotely let family members in without having to give out my code or keys.
That’s fair. I can store like 20 codes or something, so I just keep one extra in there then rotate it after whoever I had to give it to is done with needing it.
I live on a really busy street in a city, so I’m really not worried about someone breaking a window to get inside. Sure there’s a nonzero chance a methie might smash a window, but around here it’s mostly just testing car door handles and maybe smashing the car window if there’s a visible wallet or pill bottle or something.
Walking up to my door and doing a replay attack, or sending a master password to the lock takes seconds and doesn’t look any more suspicious than a resident entering the house. This talk is from 2016, but I doubt things have gotten significantly better, and I don’t want to be replacing my door lock, or even worrying about updating firmware, whenever something like this is found (Picking BLE Locks - Anthony Rose & Ben Ramsey).
But yeah, I’m not saying anyone’s an idiot for using a smart lock or anything, odds are it will never matter either way.
There are a lot of zwave s2 locks out there. No Bluetooth at all.
128-bit AES isn’t amazing, but it’s more solid than bluetooth and most hardware locks.
Most locks, including deadbolts, can be picked or bumped in seconds. The physical lock is the weakest point. You can get zwave s2 smart locks with just pin pads, no physical key. That’s probably the most secure option.
Lock picking takes skill. I’ve defeated a deadbolt and doorknob with a cordless drill in ~15 seconds. And it’s not even all that loud.
Silicon Labs Z-Wave chipsets contain multiple vulnerabilities
Oof. Could you imagine having a vindictive neighbor who is mad at you over some dumb shit you have no idea about, then then DoS’ing your lock that has no physical key?
Again probably as close to zero as a non zero chance can be of actually happening, but idk just give me a key and some buttons for when I have bags and shit.
Also, if i decided to go in to home invasions I’d rather just carry around a phone or a raspberry pi or something and pop smart locks than carry around a snap gun.
Everything you’re saying is right though, there’s always a trade off when it comes to security.
Always have a backup trigger. A open/close sensor is hard to beat. They would have to know where it is and have access to it to bypass it. And for good measure a shock sensor to know if someone is trying to break it down.
Dream: I will slowly wake up to gently increasing morning sun
Reality: my alarm clock sound is now just the buzzing and whirring of a motor that is starting to open my blinds. Just as I fall back asleep the whirring noise starts again to increase the light level.
Yo do you write for Black Mirror?
I wish someone made a smart door lock status indicator. I don’t want my doors to unlock for me; I just want to know if I remembered to lock them.
Like you want to have a dumb lock but a smart sensor that tells you if the deadbolt is locked or open?
I remember reading some blog somewhere about a person who rigged up a sensor to alert them if their mailbox had been opened or not, you could probably design something to do similar. Idk maybe a magnetic thing to detect the bolt itself, or something to detect on the position of the latch on the interior of the door?
Found this after a quick search, sorry for it being Reddit and the video of the working solution being uploaded to gfycat.
Dumb Deadbolt Lock Detection - Reddit
It wouldn’t be hard to do if I got a hall sensor, I just didn’t want to have to mess with 3D modeling and printing a housing for it.
I wonder if contact strips could be glued to the sides of the thing the deadbolt goes into?
That’s definitely one way to approach it. You wouldn’t have to attach something to the door that way, but you’d have to mess with wires external to the device.
The ones I saw from Cisa, aside from reporting the status, could automatically lock every time you closed them
HomeAssistant can do this. Set an automation when you leave your home zone, if door is unlocked notify you.
If you have a smart lock, you can even close it. You should get cameras and an alarm system first, though.
How do you detect this condition without a motorized smart lock?
Hall sensor or a switch that gets pressed when the lock is locked.
How did you integrate this into your door reliably without interfering with the regular lock mechanism?
You could position the sensor/switch on one of the cardinal directions so it wouldn’t be in the way of the mechanism.
Mind sharing a photo of how you did this?
Shades? A real tech enthusiast uses PDLC Film!
(Seriously, I wish I could afford some for all my windows.)
Shit. I am a fossil.
Build your own! All you need is an esp32 or pi pico, stepper motor, and driver.
That’s next on my list of projects after I finish my smart microchip keyed pet feeding stalls.
I’m not sure the build-it-yourself route is the cheaper one compared to just buying a ZigBee smart opener
I think they’re saying they wish they could afford PDLC film for all their windows. If you can DIY PDLC film you probably have a 3D printer the size of a tractor trailer and are 3D printing yourself a new house or something just for for the fuck of it in the backyard of your estate.
@pearsaltchocolatebar@discuss.online was talking about stepper motors and microcontrollers, those are for motorizing a shade
Unless my client is fucking up and putting their post as a reply to the wrong comment (which is a real possibility), they replied to Telorand who was talking about PDLC film.
Yeah, I misread the comment.
I really hate that the automated shades I needed (must be plug in because they’re 18’ off the floor) are so proprietary that it’s not even wifi.
Here in Italy shutter covers are common, I have those and awnings, both can be connected to any sort of smart 2-way switch. I use BTicino for the shutters and Shelly 2PMs for the awnings
There are Somfry blind controllers with small solar panels that face outwards on the motor housing. No plug required.
I would assume those would be zigbee or z-wave or something. What does it use?
In the US, 95% of “smart” tech wants WiFi connection to a proprietary cloud and they will make breaking API changes and/or ban users for using 3rd party clients. Only phone apps with permission to see your contacts allowed!
That being said, you can usually find products that will work locally but it’s really difficult, and big-box stores almost never have anything Zigbee/Z-wave or even Matter enabled. It’s bleak.
Ew. Blinds really should be line of sight IMO. I don’t want anything related to my physical privacy living in the cloud (and that goes double for you, Ring).
Ikea sells ZigBee blinds that connect right up to any home automation hub. Pretty cheap too, in the $100-200 range for most windows.
I’m using several. Batteries are solid. I get a good 3 months with daily opening/closing. I only wish they had solar modules you could add in, but the battery tray design makes that unlikely.
It’s not zigbee or anything anyone else uses. Someone spent a little time with a software defined radio to decode some of the signal.
Ew, that’s awful.
Damn that sucks. I lived in an apartment and wound up rigging up an arduino to pull the chain on these three massive window shades in my apartment, they were seriously like 20 foot tall windows. This was back in 2015 or so, so I didn’t even bother trying to find anything off the shelf.
I love your username btw.
Yep fully agree on the exterior door locks. That is the one thing that should never be connected to anything even local servers. Also have to be careful with electronic locks in general. Some brands are terribly designed and can be bypassed in a stupidly easy way.
I’m more of a middle-ground person myself. I have Home Assistant fully self-hosted and using a secure cloudflare tunnel for external access. A few other self-hosted containers running other various things. Anything exposed to the internet requires a login. I always try to find stuff that integrates with HA, but I don’t go to the full length of finding stuff that doesn’t require the brand app to setup. I like the local control stuff if I can get it, because it usually works a lot better, but I won’t actively avoid every brand that connects to a cloud somewhere because that’s too much effort to avoid for me.
Yep.
I love tech, as long as it’s tech that I have full control over.
Home Assistant is the antithesis to this meme
There’s a difference between recognizing the risks of “smart” tech and knowing the futility of avoiding it -or- even better having the skill to mitigate as much risk as possible.