How A Few Words To Apple's Siri Unlocked A Man's Front Door

A month ago, Marcus, a 31-year-old man living in Springfield, Missouri, decided to go all in on the smart home. A diehard fan of the  Apple  ecosystem, he began outfitting his house with gadgets certified as "Works with Apple HomeKit," Apple's proprietary communication standard for controlling third-party smart home devices with iOS and its intelligent voice assistant, Siri. By the end of his shopping spree, he had 30 Philips Hue LED light bulbs, two Ecobee thermostats (along with eight temperature sensors situated throughout his house) and an August Smart Lock. He was also several thousand dollars poorer.

At first, everything worked flawlessly. His front door would automatically unlock as he walked up to his house when his phone got within a certain distance. The lights would brighten gradually after he woke up. "I work long, 10-hour days," said Marcus, who asked that his full name not be used, in an phone interview on Monday. "Having things automated lets me sleep better. For the month I've been using this stuff, I love it."

But there was one big problem lurking below the surface of his Jetsonian setup. Marcus had placed an iPad Pro in his living room to serve as a central, voice-controlled hub for his smart home. (Either an iPad or Apple TV can give remote access to HomeKit gadgets.) He used it basically as an Apple version of the Amazon Echo, a tube-shaped smart speaker that's powered by Amazon's intelligent voice assistant, Alexa. Without pressing a button, he could say things like, "Hey Siri, dim the lights," and the lights around him would dim. By placing the iPad in the living room, he could control the August Smart Lock too over a Bluetooth connection. He was so jazzed by his setup that he invited over his neighbor, Mike, to check it out.

Last Friday morning, as Marcus was pulling out of the driveway, Mike walked up with a grin asking if he could borrow some flour. Marcus responded sure and started to get out of the car to let him in. But before Marcus could do anything, his neighbor said, "I'll let myself in," and ran over to the front door. He then shouted, "Hey Siri, unlock the front door." The door unlocked.

The iPad Pro sitting in the living room was able to hear Mike through the front door and issued the unlock command. Marcus was stunned. The two laughed it off. Marcus then tried to repeat the unlocking trick several more times and was surprised by how easy it was. He didn't even have to yell that loud.

"I was baffled," said Marcus. "It was so simple. I should have seen this could happen."

He posted the incident on Reddit's technology subreddit and it went viral. Many Reddit users harangued him for simply not putting a passcode on his iPad. Apple also responded that it recommends that all users have passcode authentication enabled on their devices. Enabling a passcode would require Marcus to go up to the iPad to input his pin after issuing a voice command like, "Hey Siri, open the front door."

But that would destroy the point of how Marcus had been using the iPad. He's turned the tablet into a voice-controlled smart home hub. "I'm using the iPad the way it was marketed," said Marcus. "It's not, 'Hey Siri," and then go up and enter a pin." (Update: Apple points that hands-free "Hey Siri" functionality will work with every HomeKit accessory with the passcode turned on, just not for doors lock or garage doors.)

Instead of turning on the iPad's passcode, Marcus is reluctantly removing the August Smart Lock, making his home a little less smart than he wanted, but a little more secure too. He is no longer able to do things like let his dog walker in while he's away at work with an app.

To be clear, August isn't to blame here. The same could have happened with any smart lock running through HomeKit. August has also integrated with Amazon's Alexa voice assistant, which appears to have foreseen the problem. Users can lock the door and check on the status of the door through Alexa, but they can't unlock it.

"HomeKit doesn't give you fine grained privilege management," Paul Gerhardt, a cofounder of fellow smart lock maker Lockitron, said over Twitter. "Fine for lights and thermostats. Not locks."

Apple introduced the HomeKit standard in 2014 and it has slowly gained adoption. At the iPhone 7 launch earlier this month, Apple CEO Tim Cook said that more than 100 HomeKit devices are slated to be introduced this year alone. They range from smart door locks to thermostats to light bulbs to security cameras, and all can be controlled with Siri. And in Apple's latest mobile operating system, iOS 10, there's the "Home" app, Apple's own app for managing HomeKit-certified gadgets. In Apple's retail stores, the "Works with Apple HomeKit" badge ordains many of the smart home gadgets Apple sells.

Apple's stringent encryption requirements for HomeKit-certified products have been appealing to some third-party developers. The smart home industry has mostly been careless with securing these internet-connected devices so far, and Apple is clamping down on that. That's ultimately great for the consumer.

Still, HomeKit appears to be more of a developer initiative than any sort of consumer-focused feature at this point. But as the Apple faithful start gravitating towards the company's smart home vision, it's clear Apple has some kinks to work out yet.