The Smart Home Exploit
By default, if you have smart appliances configured in the Apple Home app, the iPhone allows full access to the “Home Control” panel from the Control Center, even when the device is completely locked and secured with Face ID. Anyone holding your phone can swipe down, access the Home panel, and instantly unlock your smart deadbolts, open your garage door, or disable your networked security cameras. In the event your phone is stolen near your house, this is a catastrophic physical security vulnerability. You must permanently revoke smart home control from the Lock Screen.
How to Disable Home Control on the Lock Screen
You can permanently secure your smart appliances via the Face ID & Passcode settings.
- Open the Settings app on your iPhone.
- Scroll down and tap on Face ID & Passcode (or Touch ID & Passcode).
- Enter your strict device passcode to authenticate.
- Scroll down to the section labeled “Allow Access When Locked.”
- Locate the toggle switch labeled Home Control.
- Toggle this switch to the Off position (the green background will disappear).
A Hardened Physical Perimeter
The change takes effect instantly. The iPhone will completely sever the bridge connecting the Lock Screen interface to the HomeKit daemon. You can now lock your phone and drop it in your driveway; if a malicious actor finds it and attempts to access the Control Center, the operating system will absolutely refuse to render the smart home buttons. To unlock your front door or open the garage, you are now strictly required to authenticate via Face ID first, guaranteeing absolute security for your physical property.