Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Landlords forcing smart locks on tenants

twitter.com

Post reply on HN
Print view View original

61–70 of 124 posts

Re: Landlords forcing smart locks on tenants

#61

Post by nicolas_t »

munchbunny wrote: post #54
nicolas_t wrote: post #35

Is there any secure smart lock? I would want one because I'm away 3 months a year and it would simplify renting my apartment on airbnb when I'm away (especially with the rent I pay in HK) but I'm also rather worried about the security implications. And from my brief research, a lot of vendors have very little documentations about security. I would obviously only consider one that has a fallback to an actual key.

I think the question you're asking isn't purely about security. You're asking about a lock that maximizes security while allowing you to digitally transmit a key - in which case I don't know of any with a track record for resisting attack. Right now the predominant attitude is basically "key control is easier than trying to secure IoT." Easier to use a physical key and manually vet who gets the key than to audit an I…

That's a good point, I could potentially disconnect the lock from internet when I'm actually staying in my apartment. When I leave it to guests, most of my important stuff are packed away.

It's a hard trade off and yes I don't trust most keylocks company to get iot security right since it's not their core competence

Re: Landlords forcing smart locks on tenants

#62

Post by Merad »

Shivetya wrote: post #36

Realtors and home renting companies use these near me. Signs that say "Let yourself in" and you can get a temporary code to go into a rental and such. From a privacy stand point there are many concerns but when renting or leasing you are already bound by laws requiring you to admin maintenance and even owners with sufficient notice. Notice timeliness is all based around the nature of the call. Plus on a safety side,…

These aren't necessarily the same thing. When I was looking for a rental house about 6 months ago, essentially all of the homes I visited were set up with a "smart lockbox".

You had to set up an account with a 3rd party service who required a picture of a photo id and a small fee ($5 for 30 days access, IIRC). The rental listings would ultimately link to the 3rd party service where you could schedule a visit to the house, then get a temporary code to access the key when you arrived. All of the homes still used traditional physical locks.

I'm not a fan of "smart" devices, but think this was actually a great service as long as the home is unoccupied. As a tenant I was able to easily visit a dozen different homes in one day without having to spend hours on the phone scheduling visits with property managers.

Re: Landlords forcing smart locks on tenants

#63

Post by wink »

iwasakabukiman wrote: post #56

Can we change the title to “landlord”? I’m only seeing on person saying this is happening to them on Twitter and the title makes it sound extremely sensationalist.

In the thread it's stated that it's probably for a few thousand apartments if I'm not mistaken - not a single building/landlord. (Bit unsure about the exact categorization here, if the landlord is just outsourcing building management.)

Re: Landlords forcing smart locks on tenants

#64

Post by rhinoceraptor »

gizmo686 wrote: post #60
rlpb wrote: post #45

Clearly it wouldn't be reasonable to impose a lower standard of safety and security than a non-smart lock. I don't think landlords would attempt to argue that principle. The argument from them will be that smart locks do not regress security and safety. Given the widespread and well known security problems with IoT devices across the industry, I think it'd be reasonable to demand assurances on this. For example, an a…

Traditional locks are more like suggestions, and have a well known attack called "lockpicking", that is easy to learn. I doubt smart locks will be less secure than that. Still leaves concern for DOS and privacy attacks.

You can't remotely pick a lock, but you can remotely hack a smart lock, and you also know when its owners are gone.

No lock is totally secure, but at least a dumb lock requires physical presence to defeat.

Re: Landlords forcing smart locks on tenants

#65

Post by michaelt »

300bps wrote: post #47
daxterspeed wrote: post #38

Earlier quoted context omitted.

On top of the software aspects many smart locks neglect the actual locking mechanism leaving the lock vulnerable to easy tricks like shimming. Smart locks also have to consider how they'll function without electricity. An exposed slot for a battery could let an attacker instantly fry the lock from the outside.

An exposed slot for a battery could let an attacker instantly fry the lock from the outside. A long time ago I got drunk at my birthday party so my wife drove us back to the beach house we rented. She parked my car so that it was about five inches overhanging someone’s driveway. Their driveway wasn’t blocked but it was a dick move and they retaliated by shaving off candle wax into my car’s door locks. Fortunately I a…

  I don’t understand setting the bar so much
  higher for them than mechanical locks.
Based on the smart lock reviews I've seen on youtube channels that review locks, rejecting 98% of smart locks on the market doesn't require that you hold the smart locks to a higher standard than the mechanical locks.

Because the reviews I've seen indicate almost all smart locks fall a long way short of the security of equally priced mechanical locks.

Re: Landlords forcing smart locks on tenants

#66

Post by kuhhk »

rhinoceraptor wrote: post #64
gizmo686 wrote: post #60

Earlier quoted context omitted.

Traditional locks are more like suggestions, and have a well known attack called "lockpicking", that is easy to learn. I doubt smart locks will be less secure than that. Still leaves concern for DOS and privacy attacks.

You can't remotely pick a lock, but you can remotely hack a smart lock, and you also know when its owners are gone. No lock is totally secure, but at least a dumb lock requires physical presence to defeat.

In that scenario though, the attacker (or an accomplice) would need to be physically present to take advantage of the unlock attack...

Re: Landlords forcing smart locks on tenants

#67

Post by jerf »

rhinoceraptor wrote: post #64
gizmo686 wrote: post #60

Earlier quoted context omitted.

Traditional locks are more like suggestions, and have a well known attack called "lockpicking", that is easy to learn. I doubt smart locks will be less secure than that. Still leaves concern for DOS and privacy attacks.

You can't remotely pick a lock, but you can remotely hack a smart lock, and you also know when its owners are gone. No lock is totally secure, but at least a dumb lock requires physical presence to defeat.

Don't forget the other major characteristics of network-connected gear; it's not just that a lock can be hacked remotely, but that all of them can be hacked at once, or even just all left accidentally unlocked because someone screwed up at Cloud Central.

The real problem with all this network connected stuff isn't even the new failure modes per se... it's the correlated nature of the new failure modes. (You know you're a Real Systems Engineer if something inside of you just screamed in terror.)

Re: Landlords forcing smart locks on tenants

#69

Post by mnw21cam »

HelloNurse wrote: post #68

What about connecting the lock to your network, collecting full network logs, and having the landlord arrested for hacking as soon as the wrong packet comes out of the device?

The landlady is having this forced onto her, so I would think the proper target would be the big org pushing the change.

Re: Landlords forcing smart locks on tenants

#70

Post by thisismyaccoun7 »

nicolas_t wrote: post #55
smileysteve wrote: post #42

Earlier quoted context omitted.

Define secure? A keyed tumbler lock can often be bypassed with a $10 kit and an hour's training via YouTube. Alternatively, without a frame reenforcement kit, a lock is bypassed with a strong kick. Finding a software hack is probably the least of your worries.

That leads to a question I had recently, I know that some insurance will only reimburse in case of thefts if there's sign of a break-in. If someone lock-picks the lock, is there a trace of a break-in? Would such thefts be covered?

You can take apart the lock and see scratches on the pins as signs of picking, but bump keys are notorious for not providing a sign of break in.
Post reply on HN