Coming from an infosec background and having touched on physical security, just don't use a smart lock:
- Best case, even with a responsible implementation, you're introducing more variables than are necessary into a supposedly secure system. If one of your dependencies fucks up, your lock is exploitable.
- Worst case, you have a typical IoT device, where the "S" stands for "security."
- In _either_ case, you're likely still going to include a physical lock mechanism for keys as a backup -- so you're basically just increasing the attack surface (significantly, I should add) by doing this.
Smart locks are currently high-risk appliances, and I'm fairly confident that most others with a security background will agree with me on that.
- Best case, even with a responsible implementation, you're introducing more variables than are necessary into a supposedly secure system. If one of your dependencies fucks up, your lock is exploitable.
- Worst case, you have a typical IoT device, where the "S" stands for "security."
- In _either_ case, you're likely still going to include a physical lock mechanism for keys as a backup -- so you're basically just increasing the attack surface (significantly, I should add) by doing this.
Smart locks are currently high-risk appliances, and I'm fairly confident that most others with a security background will agree with me on that.