In recent years we have tested various smart locks. Tedee is so far the smallest and quietest of the motor locks installed in our test lab. The following test report will tell you about the security and privacy of the Polish smart lock.
Update: Tedee contacted us after our test and fixed the mentioned issues within a very short time. The smart lock system has now successfully passed our certification process! We have updated the following blog post in the corresponding points.
The tedee system consists of a GERDA lock cylinder and the optional tedee bridge, which allows the lock to be controlled not only via Bluetooth 5.0 but also online. Existing locking cylinders from other manufacturers can also be made compatible by using an adapter.
The tedee app was subjected to a static and dynamic analysis. The app’s source code is heavily obfuscated, making it difficult for attackers to analyze and understand security relevant functions. It is noticeable, however, that the development was not only based on Security by Obscurity. By implementing certificate pinning, the communication between the app and tedee servers could neither be eavesdropped nor manipulated. During the test, no unencrypted/unsecured communication could be detected, neither via Bluetooth with the smart lock, nor online.
Bluetooth and online communication
The Bluetooth communication is encrypted according to the state of the art and thus secured against attacks from the surrounding area. The communication between app and cloud as well as cloud and tedee bridge was also TLS1.2 encrypted at all times.
The extended certificate validation integrated into the app effectively prevents even more sophisticated attacks.
The lack of transparency in the area of privacy, which we complained about, was improved by tedee in record-breaking time. The very good impression of the Smart Lock now continues in the area of privacy. Information on permissions and the trackers used are also broken down in detail. Some small points can still be added to further increase transparency. Here we are still in good cooperation.
The tedee lock can join the ranks of our previously tested smart locks that have made security a part of the product design and not just a sideline. In the collaboration, the manufacturer has also further improved privacy and mastered all areas of our certification test, which is why we are awarding our “Approved Smart Home Product” certificate to the tedee lock and tedee bridge.