Hacker News Reader

> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well.

I disagree. Even the most technologically savvy intruder isn't going to hack my bluetooth/wifi/zwave/whatever lock, they're just going to break the lock or window. And on the bright side, I can tell remotely if my deadbolts are locked, and then lock them if necessary.

I think you have the same problem as car owners. Seeing these occasionally it isn't worth the trouble. Once a prevalence of a defect is popular enough (or barely popular but easy to locate) and indictive of a good bounty it makes more sense for some to drop universal attacks and focus on only these lower visibility/noise attacks.

That’s not a problem - it is a completely rational threat model.

Have you watched the Lock Picking Lawyers videos on YouTube?

Have you even heard of LPL?

> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well.

Are they really though? Having something tell me that my front door was unlocked when I know nobody is home and nobody is SUPPOSED to be home, is yet another handy piece of info.

I mean, a good alarm system can fix that as well. Plus smart locks can lock themselves. Plus usually they're not any worse than any other lock you could get at home depot.

Agreed! Mine uses a keypad, and it also tells me who actually opened the door. Has been very useful for letting my parents and a nanny in without any nonsense.

> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well.

Given the ease of picking most locks anyway, any of those that could be set up to send a notification when locked/unlocked would at least add some logging.

The use of a standard residental lock is to prevent someone from directly opening your door. E.g. neighbor, aggressive door-to-door sales, etc. It's not intended to prevent someone from breaking in.

That's obvious, as most walls in US are just drywall. You can kick your way into a house without touching any doors or breaking any glass. Houses in the US aren't made to prevent break ins.

If you want to prevent a break in, first construct a fence around your house. Then add steel window protection. Only then you should worry about deadbolts.

Houses in the US are sheathed with OSB or plywood. There may exist very low-quality homes that are sheathed with siding, but even that would need to meet shearing stability requirements that you can't meet with drywall alone (and nobody puts drywall on the exterior of a home).

So, if you can kick through an 16" OC mounted sheet of 5/8ths OSB, then yeah, maybe you could kick your way into a house?

Exterior sheathing is a structural element. Any stick built house without it is going to struggle under the weight of a roof and a stiff breeze.

Stick-built houses in New Zealand (maybe Australia too?) don't use exterior sheathing. They rely on more horizontal cross members between studs and the interior drywall for shear strength. The drywall is specially rated for shear strength applications, and there needs to be screws every 5cm at the corners.

Interesting- is it for climate reasons?

Curiously, both the international building code and ANSI require nails be used for wooden structural panels, because nails have better shear resistance than screws, which are typically designed with withdrawing resistance in mind.

Obviously, nails don't exactly work very well with normal drywall, though I'm not familiar with structural drywall either so I'm going to assume that's why you need so many screws... one snaps and it becomes a cascading force multiplication on the remaining screws.

I'm not sure exactly why because I'm not from there, I've just seen the practice in a bunch of YouTube videos. I think historically houses there have always been very built very lightweight without exterior sheathing, and maybe it's just inertia that resists the increased cost that exterior sheathing would bring. They also build with 2x4 exterior stud walls and nearly all homes are single-storey slab-on-grade structures, whereas most of North America has moved to 2x6 exterior walls as standard (partly because it allows for more insulation) and multi-storey houses are common.

I don't know what to think about it, to be honest. Here in Canada I've started to see a lot of houses built with fibreboard sheathing with an integrated 1/2" or 3/4" outer foam insulation layer. The stuff is very flimsy and turns into oatmeal when it gets wet, but apparently it's sufficient. Builders use it because it's cheap and increases insulation and decreases thermal bridging, but I think I would prefer regular OSB sheathing with building paper, or Zip sheathing with taped seams if I could get it (I've never seen it used here before).

This is a silly myth that seems to not want to go away.

Exterior walls in many US homes are usually sheathed with 1/2" thick OSB or plywood. Given 16" spacing for studs (or 24" if your builder is cheap) you're going to have to work really hard to kick through siding, plywood, *live electrical wiring might be in your way*, plus then finally drywall.

It would be so much easier to just break a window, same as any construction of house.

"Though, for most homes, all a lock will do is keep out the people who don't want to be there in the first place. They can be good if you don't want someone snooping around without you noticing, but unless you go out of your way to get "not abysmally shitty locks," anyone with a tiny bit of skill and a bump key or bump gun can pop your doors anyway without you noticing."

For insurance purposes if nothing else, I want there to be solid evidence someone forced entry. So while my heavy duty strike plate and three hinges on the other side aren't anchored as well as I'd like and there's pretty easy access through a porch window, it's secured by an Abloy lock from https://securitysnobs.com/ so force will be required. And I can lend out a key with confidence that if I get it back, it won't have been copied in the meanwhile.

I thought about doing it a while back, but then looked over at the 8ft of windows right next to the door. Seems silly to spend effort on the door when the windows are just as kickable.

All of that said, just bought a Kwikset Halo and it came with extra long screws, for anyone curious. I'm pretty happy with it.

Any good smart lock recommendations that wired instead of wireless?

Sorry, I don't. I leaned Kwikset because of their smartkey system. You can rekey the lock to match your existing home keys. I'm not sure if any other brand does that, but it was so simple to do I'm a Kwikset guy now(even their newer dumb locks have this, too).

Schlage makes z-wave locks that are traditional schlage locks in every other way, including the key. I had all mine keyed to match by my local locksmith.

Another upside to the newer versions of the Kwikset smartkey systems: they are moderately difficult to force open, even for a pro, if they are trying to be remotely discreet - I locked myself out, deadbolt and doorknob, and it took a professional locksmith more than 10 minutes to get my front door open. Obviously drills and/or bashing nullify all of this, but I’m happy to have a secure lock.

Not wired, but I recommend the schlage z-wave deadbolts. No wifi madness, so if you want to access them remotely (I do), you have to set up some kind of home automation server and then VPN to it. No cloud for me, and encrypted z-wave is secure enough. If someone really wants in, they'll smash the window next to my front door and reach through and turn the deadbolt. Nobody's going to bother trying to hack z-wave.

At least you can force a burglar to crawl through glass. I've had burglars spend over two minutes exposed while trying to pry open my windows instead of just smashing the glass.

(If you mean windows that go down to your floor, yeah fair enough. Screws are still cheap and easy though)

My parents' home was burglarized once by incompetent amateurs who broke a window door and cut themselves in the process. I came there that weekend to check on things and discovered a mass of coagulated blood on the floor. I'd rather they had bashed in a door instead.

You can get aftermarket security film applied to windows that makes it very difficult to bust through. This saved my office from a burglary.

>It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well.

I've never looked into these much, care to expand a bit on why?

Depends on the exact make and model, but they have all the same problems as any other IoT device - insecure defaults, poor vendor support, users that can't install an update even if one is available, etc. etc. And these devices aren't just inside your house, they're right on the door! I wouldn't be surprised if a dedicated hacker could remotely open nearly any connected door lock

Yea that makes sense! It is definitely a 'device' you want to work no matter what.

You've either got a company with experience with locks trying to make a good IoT product, or a company with IoT experience trying to make a good lock.

The issue isn't so much that the intruder can hack the lock, as that the intruder can bypass the smarts of the lock with age-old techniques that had been bred out of traditional lock designs.

Eh, just get a Schlage z-wave lock and be done with it. The electronic bit is just a motor that can push a traditional deadbolt mechanism, it's otherwise like any other schlage deadbolt. Also, there are no default codes, every lock comes with unique PINs. And since it's z-wave, not wifi, it's not connected to any cloud.

I replaced mine with 3" deck screws when I moved in. Still amazed at how horrible the standard 3/4" screw is in this situation.