IMC 2026 Conference Paper

Overview

Smart home IoT ecosystems have long suffered from fragmented, proprietary protocols with no mandatory security baseline and heavy cloud dependency. Matter (2022) promised to address this through a unified, open standard with mandatory encryption, certificate-based device authentication, and local-first operation. However, whether Matter delivers meaningfully improved security and privacy in practice remains an open question.

In this work, we conduct an empirical, network-traffic-based evaluation of 25 Matter and 14 legacy devices across four ecosystems, examining::

• Whether Matter devices offer measurably stronger security and privacy than comparable non-Matter devices.
• How ecosystem-specific implementations introduce privacy exposure through mDNS advertisements and inconsistent Rotating Device Identifier behaviour.
• The risks posed by dual-stack devices maintaining persistent non-Matter cloud connections outside the Matter trust model.
• The resilience by Matter devices to traffic-inference attacks, replay attacks, and unauthorized commissioning.

Our results show that Matter raises the IoT security baseline through enforced encryption and authentication, but meaningful privacy and security gaps persist — driven by vendor non-compliance, infrequent firmware updates, and specification ambiguities that require regulatory attention.

Resources

• See IMC Conference details
• View Paper
• Github Repository (Scripts and Dataset Overview)
• Citation: A. Losty, T. Hu, D. J. Dubois, N. Shafqat, A. Ranganathan, D. Choffnes, and A. M. Mandalari, "Beyond the Hype: Empirical Analysis of Matter Standard's Security and Privacy," in Proceedings of the 2026 ACM Internet Measurement Conference (IMC '26), Karlsruhe, Germany, 2026.
• BibTeX:

  @inproceedings{losty2026matter,
    author    = {Andrew Losty and Tianrui Hu and Daniel J. Dubois and Narmeen Shafqat and Aanjhan Ranganathan and David Choffnes and Anna Maria Mandalari},
    title     = {Beyond the Hype: Empirical Analysis of Matter Standard's Security and Privacy},
    booktitle = {Proceedings of the 2026 ACM Internet Measurement Conference},
    series    = {IMC '26},
    year      = {2026},
    address   = {Karlsruhe, Germany},
    publisher = {Association for Computing Machinery}
  }