Alexa steps into security with an August lock skill
For the first time, you can use the Amazon Echo to directly control your deadbolt.
For better or worse, you can now give Alexa the keys to your kingdom. Starting today, using the new August skill on your Alexa app, you'll be able to tell Amazon's digital assistant to lock your smart August deadbolt.
To make use of the skill, you'll need an August Connect Wi-Fi bridge in addition to the company's Bluetooth lock -- the skill works with both the first- and second-generation August Smart Lock. Then, if you have an Amazon device with Alexa built-in, such as the Amazon Echo, you can give voice commands such as, "Alexa, tell August to lock the front door."
Cautious steps
The skill marks a first for Alexa. Introduced as part of the always-listening Amazon Echo, Alexa's smart home capabilities seem to grow daily. But until now, Amazon's assistant couldn't do much in the way of security, and this August skill is the first time you can use Alexa to directly control a lock.
Since it's a skill -- basically an app for Alexa -- instead of a direct integration, you have to use the extra language "tell August" when commanding your door. And as of now, you can't unlock your door with the Echo, you can only lock it and check the status. So this first step towards giving Alexa control of your locks isn't seamless as far as convenience is concerned.
Prioritizing privacy
Amazon and August's caution on this front is understandable, given that the always listening Echo can be controlled by anyone within shouting range. I chatted with Jason Johnson, the CEO and co-founder of August, who assured me that direct integration and unlocking capabilities were in the works, but Amazon and August first need to find a way to add appropriate security to that command.
I also asked Johnson how much data August would share with Amazon. "We don't give them your August account ID. We don't give them information about individual users," he said. "But certainly as you do an action through an Alexa device, they know that you've done the action...but we also don't do any kind of association of address."
The second-gen August Smart Lock.
Johnson elaborated that August doesn't even track your physical address in its own app. All it knows is what you call your properties and what you name your various locks. All geofencing information is stored locally on your phone.
An Amazon representative discussed the same topic in an email. "We take privacy very seriously at Amazon and designing Alexa skills is no different," she said. "Voice recordings are stored in the cloud in order to make the product better for our customers...Importantly, you can view and delete each utterance one at a time, or all at once."
Looking forward
Neither company was willing to share details on what that extra security step needed to unlock your door might look like. Neither offered a timeline on full integration either. For guidance, August might look to the Capital One skill, which asks you for a four-digit passcode before divulging info via Alexa.
See also
As it stands, you're not out of luck if you really want to unlock your door with Alexa, but the workaround is cumbersome. I set up a Schlage deadbolt with our SmartThings hub in the CNET Smart Home. Some SmartThings devices respond to direct voice commands given to Alexa, but locks aren't a supported category right now. Instead, I needed to use online rule-making service IFTTT to tie the lock to the Echo -- and the resulting integration made me feel uncomfortable and proved too slow to be useful.
Direct integration between August and Alexa should definitely be more responsive than needing to go through IFTTT. I can confirm after a couple of early hands-on tests that the August skill works as promised when it comes to locking the door. Time will tell if it's more secure. At the very least, both companies look to be taking the security issue seriously.
"At the end of the day, what people want to know is that somebody isn't going to compromise the system and unlock their house," Johnson said. "What's more likely is that there's a more widespread attack, that someone compromises the entire August system. What you have to do is architect the system that doesn't allow for such an attack. That, of course, is part of our architecture."