> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Alarms and Locks - URL: https://www.ostering.com/taxonomies/smart-home/oph-alarms-and-locks/ - Published: 2026-11-05T21:00:00.000Z - Updated: 2026-11-05T20:52:55.095Z - Description: Alarms and Locks: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings. - Author: Brett Crawley [Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Alarms and Locks (OPH-AL) Intrusion alarms, smoke and carbon monoxide alarms, smart locks, keypads, garage doors and gates: the devices that decide who comes in and whether anyone hears about it. ## Where it sits in the house The Alarms and Locks suit sits at every way into the house: doors, keypads, garage and the alarm panel. It is suit 5 of 13, in the Things deck. ![Alarms and Locks highlighted on the Open House cross-section](https://www.ostering.com/media/posts/146/smart-home-05-alarms-and-locks-where-it-sits-1600x900.png =1600x900) ## The table ![Smart Home Threat Taxonomy, Alarms and Locks: ID, threat, mitigation principle and design measures for all 13 entries](https://www.ostering.com/media/posts/146/smart-home-taxonomy-table-05-AL-2.png =1200x2963) ### Mappings ![Alarms and Locks: STRIDE, CAPEC 3.9 and CWE 5.0 mappings for each entry, with physical-safety flags](https://www.ostering.com/media/posts/146/smart-home-mapping-table-05-AL.png =1200x1149) ### Entries in text - **OPH-AL-A † Unlocked Without Intent.** Any authenticated call (app, voice, automation or integration) can unlock the door or disarm the alarm without fresh intent from a person, so a stolen token or a misfiring rule opens the house. - **OPH-AL-K † Smoke Alarm Silenced.** Connected smoke and CO alarms can be hushed or tested remotely, or the smart layer suppresses the local siren because the alert was 'handled in the app'. - **OPH-AL-Q † Fails Open, Fails Shut.** On a flat battery, power loss or crash the lock fails open (insecure) or fails locked, trapping people in a fire, because no one chose the failure state for that door. - **OPH-AL-J Keypad Code Guessed.** Keypads accept short codes with no lockout, show wear and smudge on the used digits, and shared codes never change. - **OPH-AL-10 Guest Code Outlives the Guest.** Temporary codes and e-keys for cleaners, holiday guests and trades never expire, or stay valid offline after revocation because the lock caches them. - **OPH-AL-9 Garage Is the Side Door.** The garage door or gate has weaker controls than the front door (a fixed code, a cloud API with no step-up, auto-open by geofence), yet it opens onto the house. - **OPH-AL-8 Arming State Leaks.** Armed or disarmed status, entry delays and lock state are readable by integrations, voice assistants and widgets, so someone outside learns when the house is open. - **OPH-AL-7 † Unlocked by a Fake Arrival.** The lock opens or the alarm disarms when the owner's phone 'arrives' in a geofence, so a spoofed location or drifting fix opens the door while the owner is away or in bed nearby. - **OPH-AL-6 Tamper Goes Unreported.** A lock forced off the door, a sensor cover opened or a siren wire cut raises no tamper alarm, or raises one only when the network is up. - **OPH-AL-5 Monitoring Path Spoofed.** The path to the alarm receiving centre (IP or cellular) can be blocked or spoofed, so the centre gets a false all-clear or a flood of false alarms. - **OPH-AL-4 Smashed in the Entry Delay.** An intruder destroys the panel during the entry delay, before it has sent anything, so the alarm never reaches anyone. - **OPH-AL-3 Digital Lock, Mechanical Weakness.** A smart lock is fitted to a weak cylinder or keeps a pickable key override, and the threat model covers only the electronics. - **OPH-AL-2 Shared Code, No Name.** The household shares one code or one account, so the log says 'code 1 unlocked the door' and nobody can tell who it was. † marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads). ## Seen in the wild No entry in this suit has a public case recorded in v1.0. That does not make the threats hypothetical; it means no case was found that matched an entry closely enough to cite. If you know of one, tell me and I will add it in the next version. --- ← Previous: [Cameras and Doorbells](https://ostering.com/taxonomies/smart-home/oph-cameras-and-doorbells/) · [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Appliances](https://ostering.com/taxonomies/smart-home/oph-appliances/) → *Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*