Hi all – I know there’s been some questions and discussion around the security approaches that we’ve taken in building the SmartThings Platform, so I wanted to make this paper available to all of you. It’s an abstract that describes our security approach at a high-level, and we’ll release a much mo…

Quick question. Since this document only addresses physical devices and their virtual representation in the physical graph. Would it be fair to assume that virtual devices and smartapp data is also owned by the user? Example, my location isn’t tied to a device (maybe the hub) is that data private? …

It may be useful to note (as has come up in various discussions / feature requests), that Access Control granularity is limited to the “Device Instance” resolution. As an example, a user can authorize a SmartApp to have full access to a particular Lock, but cannot limit that access to only the read…

And thus we’d be one step closer… “Alexa, unlock the pod bay doors.” “I’m sorry Dave, I’m afraid I can’t do that.” :satisfied:

@dlieberman Can you please let us know you intentions on answering the above questions that are not addressed in the document you shared? Or will we just have to wait till the fall when a more detailed paper is released? Also, I will ask again, since it was several months ago that I asked for it. …

[image] pstuart: Is there an official channel (besides support@smartthings.com ) to submit potential vulnerabilities or suspected private data breaches we can report our concerns to? It would be great if we really felt that SmartThings takes serious vulnerabilities as professional / industry c…

[image] tgauchat: As an example, a user can authorize a SmartApp to have full access to a particular Lock, but cannot limit that access to only the read-only Attributes, nor to particular Commands such as “lock()”, but not “unlock()”. You could do this with a special device type (kinda like t…

[image] schettj: But yeah, would be messy. It doesn’t have to be messy, in theory. The shadow Devices and virtual Devices are useful in so many ways that it would be great if they were seamlessly integrated into the platform (i.e. could be created on the fly by the UI and API / SmartApps, an…

@pstuart - Sorry for the delay in getting back to you - I’m on vacation and haven’t really been online. I’ll block off some time next week to compile and answer as many of the questions as I can. As for a forum for reporting, I’d continue to suggest using support@smartthings.com , as we can then tra…

[image] dlieberman: as we can then track issues using the support ticketing system I’ve been personally told by your support team management that they have to move tickets into the “Resolved” status as soon as possible in order to keep the queues manageable and their metrics favorable. As a …

The last time I submitted a security flaw to support they told me to bring it to the community. Unless things have changed and support has the appropriate protocol to escalate potential security issues properly, it would be nice to skip the first level support. Especially if they are the source of a…

SmartThings Security Approach - Abstract - #2 by dlieberman - Announcements

Topic		Replies	Views	Activity
SmartTiles (& "other" External Services) Security Community Created SmartApps security , webservices , smarttiles	47	10327	January 28, 2016
SmartThings Platform Security - Response from Alex Announcements	19	8842	May 22, 2016
Privacy Policy for Gen2 General Discussion uncategorized	21	3492	September 5, 2015
Platform Security SmartApps & Automations	51	7562	October 19, 2019
Simulating IoT devices Devices & Integrations virtualdevice	15	2032	January 28, 2019

SmartTiles (& "other" External Services) Security

Community Created SmartApps

security , webservices , smarttiles

47

10327

January 28, 2016

SmartThings Platform Security - Response from Alex

Announcements

19

8842

May 22, 2016

Privacy Policy for Gen2

General Discussion

uncategorized

21

3492

September 5, 2015

Platform Security

SmartApps & Automations

51

7562

October 19, 2019

Simulating IoT devices

Devices & Integrations

virtualdevice

15

2032

January 28, 2019

SmartThings Security Approach - Abstract

Related topics