Matter improves the baseline: encrypted messages, device attestation and support for secure firmware updates. It does not secure the whole product, the controller, the companion app or the maker's update behavior. Treat it as a good foundation, not a substitute for the basic checks.
Myths about the protocol
Myth: Matter devices are encrypted, so they cannot be attacked
Fact: The Connectivity Standards Alliance paper says Matter uses AES in CCM mode with 128 bit keys for confidentiality and integrity, and the paper states that communications between Matter devices are protected. Encryption defends messages in transit. It does not fix a bug in the device software or a stolen account password.
Myth: Matter replaces the need for updates
Fact: The paper lists secure over the air updates as part of a comprehensive approach, including firmware and credentials updates. That makes updating possible and safer. Whether you receive updates still depends on the maker supporting the product.
Myth: Any device with the Matter logo is certified and genuine
Fact: Matter requires devices to prove identity with an attestation keypair and certificate, and the ledger lets controllers check certification status. That is a strong control against counterfeit devices. It is not a review of every line of code in a product.
Myth: Matter only works with the cloud
Fact: The Alliance lists consistent and responsive local connectivity as a feature. Some products add cloud functions on top, so check each product's behavior and privacy terms.
Myth: Matter makes the radio network irrelevant
Fact: The paper says Matter functional security does not rely on the security of the communication technology it runs on. That is useful, because a weak Wi-Fi password then does not expose message content. It does not make the network irrelevant. A compromised router can still disrupt service.
Myth: Privacy is solved
Fact: The paper says Matter protocols are designed to share the minimum data needed and to protect communications. It also says Matter protocols by design do not directly handle human relevant information. Your privacy still depends on the apps, accounts and cloud services around the device.
The controller is a high value target
A phone or hub that manages many devices holds the credentials to all of them. Keep it updated, lock the screen and use two step verification on the related accounts.
A realistic checklist
- Check the maker's update end date before buying.
- Set strong unique passwords on the accounts and apps involved.
- Keep controllers, border routers and phones updated.
- Turn off remote access you do not use.
- Replace devices when support ends.
Quick check
Is a Matter device safer than a non Matter one?
It starts from a defined security baseline, which helps. The product still needs ongoing updates and sensible setup to stay safe.
Sources
- Matter Security and Privacy Fundamentals, March 2022
- Connectivity Standards Alliance: Matter
- NCSC: Smart devices, using them safely in your home
Last reviewed: 19 October 2026.
