The Physical Security Exploit
By default, iOS deeply integrates with Apple’s HomeKit architecture, placing a “Home Control” button directly within the Control Center on your Lock Screen. Incredibly, the operating system allows anyone to swipe down and tap this button to turn on lights, adjust thermostats, or even unlock smart doors, even when the iPhone is completely locked and secured with Face ID. This means a thief who steals your phone can potentially manipulate the physical security hardware of your house without ever knowing your passcode. You must permanently seal this physical security leak.
How to Disable Home Control on the Lock Screen
You can permanently secure your HomeKit integration via the Face ID & Passcode settings.
- Open the Settings app on your iPhone.
- Scroll down and tap on Face ID & Passcode (or Touch ID & Passcode).
- Enter your strict device passcode to authenticate.
- Scroll down to the section labeled “Allow Access When Locked.”
- Locate the toggle switch labeled Home Control.
- Toggle this switch to the Off position (the green background will disappear).
A Hardened Physical Perimeter
The change takes effect instantly. The iPhone will completely sever the bridge connecting the background HomeKit API to the Lock Screen UI renderer while the device is locked. You can now leave your phone unattended on a desk; if a malicious actor wakes the screen and attempts to access the Control Center, the Home Control buttons will be completely absent or disabled. To manipulate the physical hardware in your house, you are now strictly required to unlock the phone with Face ID first, guaranteeing absolute control over your physical environment.