Your Smart Plug Is a Computer Too

A smart bulb doesn't feel like a computer. It's a light bulb. But inside it is a tiny computer with a network connection, running software that someone wrote, talking to servers somewhere on the internet. Multiply that by every plug, camera, doorbell, speaker, thermostat and robot vacuum in a house and you've got a lot of computers that nobody ever thinks about updating.

That's the core of the smart home security problem. These devices are cheap, plentiful, and frequently made by companies whose main skill is hardware, not security. Some get updates for years. Some get a couple and then nothing. Many have no screen and no obvious way to tell you anything is wrong.

What can actually go wrong? A few realistic things. Cameras and baby monitors with weak or reused passwords can be accessed by strangers, which is the scenario that genuinely hurts people. Compromised devices get recruited into botnets that attack other sites, often without the owner ever noticing. A vulnerable device on your network can, in principle, become a foothold for reaching your other devices. And separate from hacking, a lot of these products collect more data than you'd expect and send it to the manufacturer's cloud.

The good news is that the defenses are mostly simple. Here's what I'd do.

Buy from companies that support their stuff. Before you buy, look at whether the brand publishes security updates, how long they've supported older models, and whether they have a way to report vulnerabilities. A slightly more expensive device from a company that's still patching its five-year-old products is a better deal than a bargain one that will never see an update.

Change default passwords and use unique ones. If a device or its app has its own account, give it a strong, unique password from your password manager. Turn on two-factor authentication for the app accounts, especially for cameras and locks. Your camera account is effectively a window into your house.

Keep firmware updated. Turn on automatic updates in each device's app if the option exists. Every few months, open the apps and check for anything pending.

Put them on their own network. This is the single most effective step. Most decent routers can create a separate network for IoT devices, often labeled as a guest network or a separate SSID, ideally on its own VLAN if your gear supports it. The point is that if a smart plug gets compromised, it can't easily reach your laptop or your NAS. Your phone may need to be on the same network during setup, but day to day the devices can talk to their cloud services from their own corner.

Turn off what you don't use. Remote access you never use, UPnP on your router, voice purchasing on a smart speaker, cameras in rooms where you don't really need them. Fewer features means fewer things to go wrong.

Think about where cameras point. Indoor cameras in bedrooms and bathrooms are a risk I'd rather not take. If you do have indoor cameras, look for ones with a physical privacy shutter or a schedule that turns them off when you're home.

Consider local control. Platforms like Home Assistant, and standards like Matter and Zigbee, let a lot of devices work locally without depending on a manufacturer's cloud. It's more setup, but your lights keep working when the company's servers go down or the company goes away, and less of your data leaves the house.

Retire devices properly. When you get rid of something, factory reset it and remove it from your account. Otherwise the next owner might have access to your stuff, or your account might still have access to theirs.

None of this requires paranoia. Smart home gear can be genuinely convenient and I'm not telling anyone to rip it out. Just treat each device like the little networked computer it is, give it a strong password, keep it updated, and keep it in its own room on your network.