(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| August Wi-Fi Smart Lock (4th Generation)
|
|
Security Grade
Calculator v
|
August Wi-Fi Smart Lock (4th Generation)
Release Date: 2020-09-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The lock mounts on the interior side of the door over the existing deadbolt, with a DoorSense sensor and retained physical key; physical tampering requires door/attack surface rather than a remote interface.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Historical CVE-2019-17098 affected Android provisioning of the older August Connect Bridge with a static key; it was patched in Aug 2020 and does not directly cover this built-in-Wi-Fi 4th-gen lock.
|
| Prior attacks
|
None
|
🔗 Proof
|
No confirmed physical break-in or real-world exploitation through these disclosed August vulnerabilities is documented; bounded review, absence of evidence is not proof of absence.
|
| Updatability
|
Rare
|
🔗 Proof
|
August pushes firmware updates through the August app (e.g. v2.1.8 guest-key fix in Aug 2020); third-party reporting notes firmware updates are RSA-signed, with no widely exploited update flaw found.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The August app account pairs with Alexa, Google Assistant, Apple HomeKit and SmartThings, but remote and guest-key control is anchored to the August account rather than full identity federation.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
August states the lock uses Bluetooth LE encryption (AES-128 reported) and TLS in its mobile applications for cloud and app traffic.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Virtual guest keys and lock state are managed through the August cloud and app over TLS; no plaintext local credential storage is documented.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
August supports account login, guest-key issuance/revocation, member management and mandatory second-factor verification via email or phone, plus lost-phone remote key disable.
|
| Authentication
|
Secure
|
🔗 Proof
|
Access uses an August account with email/phone 2FA, optional phone biometric (fingerprint/Face) unlock, and pairing that requires August app authentication.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
August account 2FA and BLE pairing authentication resist credential stuffing; voice unlock may require a PIN, and lost virtual keys can be revoked remotely.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
The August app Activity Feed records who locked/unlocked the door and when, supporting audit of access events.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
There is no default device password; a personal August account credential is created during in-app setup. Per methodology this is the mid-tier no-default-password case.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Proprietary August embedded firmware (OTA-updated via August app) (Companion App: August app for iOS/Android; works with Apple Watch, Alexa, Google Assistant, Apple HomeKit, Samsung SmartThings)
|
| Hardware (CPU / GPU)
|
CPU: Not applicable (not published by August) • GPU: Not applicable (not published by August)
|
| Memory & Storage
|
Memory: Not applicable (not published by August) • Storage: Not applicable (not published; stores virtual keys locally)
|
| Power, Battery & Charging
|
Battery: 2x CR123 batteries (included); up to ~3 months battery life • Power: Battery powered (2x CR123); no mains connection • Charging: Not applicable (user-replaceable CR123 batteries)
|
| Display & Camera
|
Display: No display; status LEDs • Camera: None
|
| Sound & Connectivity
|
Sound: None (no speaker; status feedback via app and LEDs) • Connectivity: Built-in Wi-Fi 802.11 b/g/n (2.4 GHz; product page also lists 5 GHz), Bluetooth Low Energy, DoorSense sensor
|
| Physical (Dimensions & Mass)
|
Dimensions: Diameter 72 mm, depth 46 mm • Mass: Approx. 0.35 kg (13 oz) per third-party spec sheet; August retail page lists dimensions but not weight
|
The August Wi-Fi Smart Lock (4th Gen) is an interior retrofit deadbolt with built-in Wi-Fi, two CR123 batteries, DoorSense and BLE, controlled by the August app. Its notable historical flaw, CVE-2019-17098, targeted older Connect Bridge provisioning and was patched in August 2020; this 4th-generation built-in-Wi-Fi unit is outside that bridge direct scope. August advertises BLE AES and TLS encryption, account 2FA, guest-key management, RSA-signed firmware and an Activity Feed, giving relatively strong account- and app-layer controls for a retrofit lock.
