Troy Hunt challenges the idea that smart locks are inherently less secure

The Have I Been Pwned founder says connected locks can reduce everyday security failures, but warns that software flaws, compromised accounts and poor vendor disclosure create risks conventional hardware does not.

Troy Hunt’s latest remarks on smart door locks have sharpened a debate that sits at the junction of digital and physical security. The founder of Have I Been Pwned has argued that connected locks should not be dismissed as automatically weaker than conventional hardware, because a traditional deadbolt can still fail through poor installation, copied keys, or simple human error. At the same time, connected systems introduce risks that mechanical locks do not share, including firmware flaws, account compromise, connectivity failures and dependence on vendor support. Security specialists broadly agree that the better question is not whether a smart lock is always safer, but which system is stronger in a particular home and threat model.

Hunt’s comments followed criticism over an earlier warning about a vulnerability affecting a Yale lock. He questioned why customers were being asked to update devices before the company had explained the problem in public detail. That concern was about transparency as much as technology. A security advisory is only useful if owners know which model is affected, how serious the flaw is, and whether the fix needs to be applied immediately. Without that information, users are left guessing whether they are dealing with a routine maintenance issue or a serious exposure.

The case for smart locks, however, is not hard to understand. Traditional locks cannot usually tell a homeowner whether a door has been left unlocked, whereas a connected system can report its status and, in some cases, trigger automated checks before bedtime or when the household leaves. That may sound modest, but it directly addresses one of the most common security failures: forgetting to lock up. Industry guides comparing the two approaches make the same point, noting that quality and installation matter more than the label on the box.

Digital credentials also change the way access can be controlled. A copied physical key is difficult to revoke without changing the lock or rekeying it, which can be awkward after a cleaner, contractor or former tenant has had access. Smart systems can sometimes disable an individual user, expire a temporary code or withdraw permission remotely. That is a practical advantage for homes that regularly manage short-term access. Yet those benefits depend on the product’s architecture. If a system relies on cloud services, weak account protection or cached permissions, revocation may not be immediate or complete.

Another advantage is accountability. Mechanical locks rarely provide any record of who opened the door or when. Smart access systems can keep logs, helping homeowners check whether a visitor arrived on time or whether an unexpected entry needs investigation. But those records should not be treated as infallible proof of identity. Shared codes, compromised accounts and inaccurate timestamps can all undermine the value of an audit trail. As several home security guides note, logs are helpful, but only if the credentials behind them are managed carefully.

Hunt also pointed to the limits of physical security. In one anecdote, he described how quickly a locksmith opened a conventional lock after his connected lock ran out of battery power. The point was not that all mechanical locks are weak, but that many are far easier to defeat than people assume. Pick resistance, key control, door alignment, strike-plate quality and the strength of the surrounding frame all affect real-world performance. A strong deadbolt on a badly fitted door can still fail. Equally, a smart lock installed on weak hardware is only as good as the weakest part of the assembly.

That is why the comparison should include the entire system, not just the door mechanism. Hunt said he was beginning to use Ubiquiti Access, an access-control platform that combines electronic management with physical hardware such as electric strikes and drop bolts. Products of that kind show how modern access control is becoming more integrated, but they also make the security picture more complex. Power loss, emergency exit behaviour, local network resilience and account security all become part of the design. A device that is convenient in daily use can still become a liability if it is poorly supported or badly configured.

The most defensible conclusion is that smart locks are neither a universal upgrade nor a universal risk. They can reduce everyday mistakes, improve visibility and make access easier to manage. They also widen the attack surface by adding firmware, software and service dependencies that need maintenance over time. Conventional locks avoid those digital risks, but they bring their own weaknesses, particularly where keys are copied, lost or never fully recovered. Hunt’s argument is best read as a reminder that security depends on how a system actually works in practice, not on whether it is labelled smart or traditional.