How can I securely support unlocking my door through Google Home?

Question

There are several brands of door locks supported by SmartThings, all of which could be used to secure someone's front door. After some research, I found it was possible to create a virtual switch to control the lock, so that Google Home can control it.

However, in that thread, there's an interesting point about controlling locks through a voice assistant:

One concern people have raised. If you enable voice control of locks, someone could stand outside your house and tell your voice system to unlock the lock.

Surprisingly (or perhaps not!), this has already happened with an August Smart Lock controlled by Siri:

Last Friday morning, as Marcus was pulling out of the driveway, Mike [Marcus' neighbour] walked up with a grin asking if he could borrow some flour. Marcus responded sure and started to get out of the car to let him in. But before Marcus could do anything, his neighbour said, "I'll let myself in," and ran over to the front door. He then shouted, "Hey Siri, unlock the front door." The door unlocked.

For the setup of a Google Home controlling a SmartThings lock that I proposed at the start of the question, how can I avoid intruders or unwanted visitors from opening my front door? Is the only viable option simply disable it altogether, or might it be possible to modify the setup so that it is more secure?

Answer 1

Generally you want your home's door secure.¹

Assuming that the door is secure in itself, i.e. it cannot be opened without the lock, the security of the door is equivalent to the security of said (smart) lock. Further assuming that the the smart lock itself is secure for the moment we can concentrate on the trigger.

Triggering a smart lock with a voice assistant

Generally there are three options to verify that only an authorized person can open the door. Those are called authentication factors, either the person knows something, the person has something or the person is someone. Those can be combined into two-factor, three-factor or even more-factor authentications. The corresponding Wikipedia page is an interesting read about those. The voice assistants currently are unable to discern between voices.

That inability excludes possibility three, identifying you being you outside your door. On its own, it's obviously unable to check you for having something specific too. That leaves one authentication factor, you knowing something.

Thus, you'll have to configure Google Home or SmartThings or the smart lock to not react to generic commands, but only to specific ones you set. The simplest thing would be renaming your smart lock device. It would leave you for example with the command, Ok, Google, open the hidden kingdom.

As with every authentication that is based on knowing something, which is essentially a password, or in this case more aptly a passphrase, the usual rules apply.

• Change it from the default value
• Change it regularly
• Make the passphrases hard to guess (and easy to remember)
• Don't tell anyone unauthorized

Since you literally have to say that passphrase in semi-public with passing neighbors, in front of guests and in easy reach of malicious listeners you'd optimally never use a passphrase twice.

This is why I haven't provided any actual configuration possibilities. Without adding another factor to the voice activated smart lock this is just a truly insecure idea.

Possible second factors could be a face-recognition camera being activated by voice which verifies your identity and opens the lock or a proximity check for your smart phone. Thus, adding factor being someone or having something to the really weak knowing.

---

_{1 citation needed}

Answer 2

I use Alexa, it does recognizes voices. Also, my Alexas are not placed that close to the door. I also have double glazing. So, you would have to shout really really loud, it will probably need a loud speaker.

On the other hand, in modern houses, ingress is hardly an issue, just break any of the glass panes on windows or doors.

I have what is called an electric door strike for my front and back doors. They are controlled by a secure keypad, for us to use to come in keylessly. But it is controllable by Alex as well.