Author Topic: Can You Unlock a Door Lock with a Remote Controller?  (Read 11489 times)

Offline LibraSun

  • Hero Member
  • *****
  • Posts: 542
  • Karma: +0/-0
Can You Unlock a Door Lock with a Remote Controller?
« on: August 04, 2009, 08:16:46 am »
After reading the Schlage Lock wiki:
http://wiki.micasaverde.com/index.php/Schlage_Lock
 I was left with the following impressions:

1. Vera tries to prevent the use of a handheld remote or scene controller to "unlock" a door lock or deadbolt.

2. For locks which happen to function "backwards" - that is, Vera reports it "locked" when it's unlocked, and vice-versa ... resulting from an improper lock orientation during installation - Vera offers the ability to set Parameter #305 "Reverse" to TRUE (a binary value of 1).

Now, my sneaky question:

Is it conceivable that a Vera user could override Vera's "never unlock via remote or scene" mandate, by (a) setting Parm #305 'TRUE', then (b) controlling the lock "backwards" intentionally?

That is, in day-to-day use, he'd know to click "Unlock" when he wanted to lock the door.  And on his handheld remote, or using a Scene, he could ask an unwitting Vera to "Lock" the door, and it would in fact unlock??

Call me crazy...   :D
« Last Edit: August 04, 2009, 08:19:18 am by LibraSun »
Vera Model I running UI4 (Firmware 1.1.1338), died in 2015
Vera Plus running UI7 (Firmware 1.7.2935)

Offline micasaverde

  • Administrator
  • Hero Member
  • *****
  • Posts: 1667
  • Karma: +15/-1
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #1 on: August 04, 2009, 12:47:08 pm »
We were originally going to allow the ability to lock/unlock doors using remotes and just have a warning notice for the user that this introduced a security risk because someone could impersonate the scene controller to unlock the door, since the scene controller isn't secure.  In the real word it's perhaps not likely to be a real threat because the would-be intruder would need to know the homeowner has a Z-Wave system and how Vera works, know which scene is setup to control the lock, and which button on which scene controller with which node id triggers the scene.

Regardless, there was concern that, even if we warned the user of the risk, we could still get sued if someone used this to get into a home.  So, we simply disabled the ability to add 'unlock' to a scene.  If the user wants to get under the hook and modify the user_data json file by hand to force an 'unlock' into a scene, or do other low-level stuff like reversing the lock so that 'lock' really 'unlocks', then presumably the user must really know what he's doing and can't hold us responsible.  Our goal isn't to mandate or judge what level of security homeowners feel is necessary for their neighborhood, or force a level of security the homeowner feels is unnecessary.  After all, half their neighbors may still have spare keys under the mat.  Each person can make his own judgement about where to draw the line between convenience and security.  So our goal isn't to block users from unlocking doors with their key fobs or scene controllers if that's what they really want to do.  We just don't want to get sued if their home gets robbed.  Therefore, unless a user does something to explicitly on his own to deliberately bypass the default security settings, by default, Vera should be secure.

So it seems we have 3 choices: 1) Disable the 'reverse' function.  This should be harmless because I think the only time the lock/unlock got reversed was when a user installed the lock incorrectly and the little black plastic knob that pushes the sensor to indicate lock/unlock was somehow incorrectly oriented.  2) We get rid of the ability to do a 'lock' in a scene.  Personally I think the 'lock', though, is really nice.  It's nice to have one 'go to bed' button that locks the house and shuts off the lights, without having to whip out the cell phone control to lock the doors separately.  Or, 3) we leave it as is.

I guess the best bet is #1, and we can remove the 'reverse' function.  Any users who incorrectly installed the locks will then need to install them correctly.  Any other comments?
« Last Edit: August 04, 2009, 12:59:25 pm by micasaverde »

Offline LibraSun

  • Hero Member
  • *****
  • Posts: 542
  • Karma: +0/-0
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #2 on: August 04, 2009, 12:57:19 pm »
Very good answer.  Thank you!

My curiosity has been satisfied.   8)
Vera Model I running UI4 (Firmware 1.1.1338), died in 2015
Vera Plus running UI7 (Firmware 1.7.2935)

Offline guessed

  • Master Member
  • *******
  • Posts: 5294
  • Karma: +90/-22
  • Release compat is not a bolted-on afterthought
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #3 on: August 04, 2009, 01:27:30 pm »
MCV, you could also add a Device-specific Setting for the Lock devices with the following Domain values (from a drop-down):

    Secure - Not usable in Scenes
    Insecure - Lock permitted in Scenes
    Insecure - Lock and Unlock permitted in Scenes

This would permit the user to be as "Secure or Insecure" as they want in the use of Scenes, plus you'd likely have a "reasonable way out" for Legal verbiage.  It also moves the Scene awareness from being Device-specific, to being Device-instance specific.

A setting like this might also be generally useful for other Device instances also, similar to how the "Hidden" attribute works for UI/Rendition.

aka. "Do you want to participate in Scenes?"


My current Alarm Panel definitions clutters the Scene selection list(s) with about 100 device "instances", most of which wont really do anything and have already been "hidden" from the runtime UI.

Offline micasaverde

  • Administrator
  • Hero Member
  • *****
  • Posts: 1667
  • Karma: +15/-1
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #4 on: August 14, 2009, 10:38:31 pm »
that's a good solution

Offline JaseP

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +0/-1
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #5 on: December 31, 2009, 11:08:25 pm »
As a lawyer, my opinion is that if you were include verbiage that states to the user that they have selected an insecure setting, and make it big and bold enough, with enough confirmation screens (e.g.: "Are you Really Really sure you want to do this???"). I would say you pretty much have the CYA stuff handled... The user having knowingly assumed the risk... Of course my legal opinion is only good in PA where I'm licensed.

Offline denix

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 1087
  • Karma: +1/-0
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #6 on: January 04, 2010, 08:19:23 pm »
Ah, we have lawyers on the forum... Good to know :)
Veras (1, 2, 3, Lite, Plus), lots of different Z-Wave modules, Luup plugins and theater/security integration.

Offline txpatriot

  • Sr. Newbie
  • *
  • Posts: 36
  • Karma: +0/-0
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #7 on: January 06, 2010, 10:39:01 pm »
For exterior locks, of course, it's a security risk.   But one of my locks is an interior lock, designed to keep snooping kids out when parents aren't home.  I would be perfectly comfortable adding it to scene, such as, to unlock the bedroom door when my personal code is used in the front door lock.  Or to add to a button on the controller I keep in the bedroom.   

I'll be happy to click on any disclaimers necessary. :)


Offline SAAUTO

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #8 on: January 24, 2010, 06:45:26 pm »
I assume that all this discussion is now moot since Kwikset has announced that micasaverde.com is a partner with their newly Z-Wave enabled Kwikset SmartCode with Home Connect locks.  Please confirm.

http://www.kwikset.com/WirelessLocks/Partners.aspx

Thanks, SAAUTO

Offline denix

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 1087
  • Karma: +1/-0
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #9 on: January 24, 2010, 07:46:02 pm »
I assume that all this discussion is now moot since Kwikset has announced that micasaverde.com is a partner with their newly Z-Wave enabled Kwikset SmartCode with Home Connect locks.  Please confirm.

http://www.kwikset.com/WirelessLocks/Partners.aspx

Thanks, SAAUTO

This discussion was about the security risks associated with unlocking a door lock with a regular Z-Wave remote controller, as it's not secure and does not implement the encryption layer, being the weakest link. I haven't seen anywhere on the Kwikset site that this is no longer an issue...
Veras (1, 2, 3, Lite, Plus), lots of different Z-Wave modules, Luup plugins and theater/security integration.

Offline myhomeserver

  • Beta Testers
  • Hero Member
  • *****
  • Posts: 872
  • Karma: +3/-5
  • http://www.MyZwave.net
    • MyZwave.net
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #10 on: February 01, 2010, 01:34:12 pm »
I've been working with a local locksmith on designing a package for handicap and bedridden folks to have the ability to unlock the Schlage LiNK deadbolt with a GE 45608 remote and it's working perfectly.  In some cases the door is locked and they can't get up to unlock it and this ability to assign a scene to the remote and have that scene unlock the door.   

In order to see who's at the door, we use Linksys WVC80N camera's that can stream a mjpeg video for confirmation.  I'm looking at moving this to a WIFI handheld and making a custom App that embeds the video and unlock button on a webpage.

I'm glad this isn't removed, I realize the security risks, but part of our package is the loaded .45 cal revolver on the bedside table :)  hehehe
MyZWave.net - See Our Z-Wave product Reviews
(formerly MyHomeServer)

Offline denix

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 1087
  • Karma: +1/-0
Re: Can You Unlock a Door Lock with a Remote Controller?
« Reply #11 on: February 01, 2010, 03:53:55 pm »
I realize the security risks, but part of our package is the loaded .45 cal revolver on the bedside table :)  hehehe

That's one hell of a package! :)
Veras (1, 2, 3, Lite, Plus), lots of different Z-Wave modules, Luup plugins and theater/security integration.