Hacker News Reader

Comment by drunner | Hacker News Reader

I mean, any security camera that does anything with the cloud should never make it onto a recommendation list in the first place.

I'm not sure if the product exists, but something that replicates a homemade setup would be amazing.

Think of a bundled camera(s) + raspberry pi + 1tb backup drive or whatever that you can only access over your own dedicated personal wireguard vpn (or tailscale, something like that), but sold as a retail bundle.

Of course, that would cut out all the SaaS/app data selling aspect so it seems unlikely to happen.

View on HN

The market for a product that requires the buyer to setup a VPN is not going to be very large. You seriously overestimate the average tech competence of people. It needs to be something you just plug in and it works.

cloud camera's aren't that either, most require the download of an app, signing up, configuring the camera, etc.

You could just as easily give local camera's the "printer" treatment, and most people are somehow able to successfully setup printers on their PC's.

Wyze camera setup is pretty straightforward. Add a camera in the app, it opens a QR code on the phone screen, and you just scan that with the Wyze cam. It seems fool-proof.

With that being said, I did still have to setup the Wyze cameras for my 50 year old tech-inclined dad, haha.

I could, however, imagine you buying a "$BRAND hub" for your "$BRAND camera" and other $BRAND IoT that ostensibly set-ups a tailscale kinda thing you can access via the $BRAND App, all while not touching the cloud.

It's ostensibly the same UX as the current cloud set-up, only without the operational costs of running a cloud service.

> I could, however, imagine you buying a "$BRAND hub" for your "$BRAND camera" and other $BRAND IoT that ostensibly set-ups a tailscale kinda thing you can access via the $BRAND App, all while not touching the cloud.

I'm confused by the use of the word "ostensibly" there. Do you mean that the makers would claim that it would set up a tailscale kinda thing for you while doing something completely different to avoid the cloud?

No, I used "ostensibly" to indicate that it wouldn't nescessarily be Tailscale but some sort of VPN that appears to have a similar UX. Honestly probably not the correct phrasing.

Sorry that it wasn't clear.

Raspberry Pis have been sold out forever. There are plenty of competent people buying hardware with the training wheels removed.

Plenty relative to a small absolute number overall - right? I don’t know RPI sales but the difficulty buying them doesn’t signal that loads of average folks want to bother.

I have both RPI local cam set up and Wyze. Despite concerns, hard to argue with pure convenience of Wyze (and similar products)

One of the reasons for them being sold out is a lot of the demand for Raspberry comes from industrial customers. For example, back in 2020, they made up 44% of total Raspberry Pi sales.

Source: https://www.raspberrypi.com/news/supporting-raspberry-pis-in...

3.2 million users subscribed to the main raspberry pi subreddit alone. That shows there's a pretty good amount of users for a hardware product like this.

A) If customers can't manage select a properly secure cloud camera system, what makes you think they're going to do a good job picking a VPN vendor and setting up their product? But perhaps more importantly..

B) What about the apparently huge majority of us that prefer these devices precisely because the video is not stored on-site?

I'm fully capable of all of the technical stuff and have done it before.

It's just a complete pain in the ass. I have a collection of "cool, but painful to maintain" devices.

I disagree. I submit that you rather underestimate the tech competence of people - humankind have done far more with less resources due to ingenuity.

An IP camera that requires the customer to set-up and secure outside access themselves will not sell to end users. The market is just too small and anyone who has the skills to secure this stuff themselves doesn't have to rely on a consumer grade product.

Me, I am a potential customer! I have the skills to set this stuff up but don't have the $$$$$ to go with a commercial grade solution. Something more in the raspberry pi paradigm of price to performance is exactly what I'm looking for in this space. Just give me a cheap camera and access to io.

Wyze offers RTSP firmware: https://support.wyze.com/hc/en-us/articles/360026245231-Wyze...

Unless I'm misreading, it's not available at this time:

> RTSP was considered a beta feature and we are currently assessing the path forward as the firmware versions have aged quite a bit. We have removed the firmware files for these versions for now and we’ll update the pages when plans are finalized. Please note that firmware files take a while to work on and test so you may not see an update in the near future.

Idea: could you cut off external network access and then point a server (e.g. HomeAssistant server on RPi) to the RTSP feed from the camera within your network?

your certainty is not based on reality.. "pet rocks" sold millions; BetaMax failed; great movies went unwatched, where stupid schlock got paid. Markets are not predictable entirely at all.

This is an established market, we are looking at the the survivors. It's reasonable to assume that a product we come up with within 5 minutes has been tried and didn't make the cut.

That's the architecture of Ubiquiti Protect: https://blog.ui.com/2019/01/09/introducing-unifi-protect/

What is the current verdict on Ubiquiti being trustworthy after the incidents with Krebs?

Ubiquiti is trustworthy.

Krebs jumped the gun on that accusation and apologized

https://krebsonsecurity.com/2022/08/final-thoughts-on-ubiqui...

If you're cool with the NSA backdoor that got leaked yesterday.

https://news.ycombinator.com/item?id=37570407

Thanks. I thought I had recently seen the Ubiquity name in the headlines again after the Krebs debacle. I just didn't realize it was that recently.

For home security stuff? None of it will be exposed to the internet so I don't particularly care.

Do you honestly believe that a now public NSA style backdoor will never be used by anyone that is not NSA? Of course goofy script kiddies will be using this to see what cameras are seeing and then do a range of things from posting embarrassing images to the web for the lulz or up to blackmailing people. that's with less than 3 seconds of thinking about what a vuln could do for non NSA types

I think having all of this stuff behind a firewall and not exposed to the internet makes a pretty big difference. If an attacker gets onto my LAN, it's game over.

Mass produced consumer gear that is also perfectly secure probably doesn't exist. I assume everything I use has bugs and none of it will stand up to a dedicated attacker.

As for blackmail, my cameras all point outward. I suppose they could threaten to report me to the HOA when my grass gets too long...

and exactly what firewall hardware is being used so that you feel assured that it is also not prone to the same issue?

I'm almost certain it does have the same issue. I don't believe there's any networking gear out there that is believed to be bug and exploit free now and expected to stay that way in the future.

I believe a dedicated hacker could use the microphone and camera in my phone and laptop to spy on me. They could look at the street in front of my house. They could see my entire browser history, everything I've printed, every call I've made, everything I've said over email or text message.

That’s not ubiquity specific that’s all cavium based networking gear which is a substantial fraction of all networking gear. I’d be shocked if similar back doors aren’t present in other common network chips.

If you're not cool with it, where are you going to go?

Cisco? https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...

Juniper? https://www.schneier.com/blog/archives/2021/09/more-detail-o...

Huawei?

I know OPNSense is using AMD Epyc(embedded) in their routers and that their software is open source. Maybe not enterprise enough, or too big for consumers, but I've been rocking the DEC3860 and it's been a really smooth ride. Is AMD compromised? It wouldn't surprise me...

Since it's such an old report, it's most likely referring to Dual_EC_DRBG: https://en.wikipedia.org/wiki/Dual_EC_DRBG

So don't read the article as being about Unifi currently being backdoored by the NSA, but that the USG3 was one of the products using the Cavium/Marvell chips with the flaw that were being used globally in 2013 when the Snowden archive was released.

Isn't that like 2nd or 3rd time he did that now?!

I'm in two minds about Ubiquiti products. They're starting to become a bit more user hostile and I don't entirely trust their web based products.

However, you can set things up to run locally with self hosted servers. I've got a couple of wifi points, a switch and the old security gateway along with a couple of their cameras. I've got the Unifi device management software running in docker on a Raspberry Pi swarm and the old Unifi Video server running on x86 hardware in docker. It's probably about time I figured out how to self host the Protect server and move the cameras to that.

What a strange take. You are saying that we probably shouldn’t use the internet at all, because there is potential for something to go wrong. You probably shouldn’t live in a house either, because someone might break in. We should probably stop using bicycles or even walking because you might fall and hit your head…

I think the take is far far narrower than that. Although there is no practical/technological problem of hosting your security cam videos on 3rd party servers there is a legal problem which is once you do that data is no longer legally yours and can be silently used without your permission.

I think the minimum requirement for a legally secure cloud hosted camera is E2EE and the camera can't upload unencrypted video at all without the decryption key from the owner.

Imagine the customer support costs of trying too help users troubleshoot VPN connection issues to their phones when they don't get their alerts.

And the huge mess of bad publicity, when someone breaks into a home, and as part of the theft, steals the device that has all the video of their crime.

What about cloud services that offer end to end encryption?

It seems like HomeKit Secure Video has pretty good security design: https://support.apple.com/guide/icloud/icloud-homekit-secure...

Frigate, Coral TPU, and Tailscale/Headscale form a reasonable local solution for those who want to explore setting up their own system.

NTFY and Node-Red, with a dash of MQTT, can be bolted on for remote alerting.

I'm confused. Wyze cameras offer cloud-free operation, storing to an SD card, is the vulnerability still there even without cloud hookup?

Lots of vendors sell something like that you just need to look for an NVR. Ubiquiti, Synology, Reolink, Amcrest etc all sell products like this to varying extents, but other companies have realized you can make better money selling outrageous cloud subscriptions for subsidized hardware.

It would be nice to just have a data service you sign up to personally that basically just gives you an AWS bucket, and products such as this just takes a key and URL to upload/download with.

Yeah I would love something I update occasionally and just hook up to my aws account. probably a small market though.

I mean, you’re not wrong, but the family of five that just moved into $SUBURB and demands max safety for some reason is definitely not gonna do all of that and will just buy Ring or Arlo.

I consider offsite storage a must-have feature for surveillance equipment, because one of the prime threats is that the thieves carry off the surveillance equipment itself. With modern WiFi cameras without mounting wires and cheap plastic mounting points, that's real easy, and if you had a physical server to store the recordings it would be a target as well; the history of surveillance systems is littered with examples of "The thieves stole the tapes, too".

Finding someone trustworthy enough to store your offsite footage, though, is a real problem. If only there were some sort of union of peoples capable of causing consequences for companies that act as poor stewards of data.

>If only there were some sort of union of peoples capable of causing consequences for companies that act as poor stewards of data.

Would be a great idea! Your wish is granted! Only one catch. The only consequence they can actually level is an insignificant fine ~ 1% of the profit they've made violating the law. Oh, plus a pinky pwomise to not do it again after a finger wag, or they'll get real angry, and the fine will be UP TO a whopping FOUR percent of profits!!!

Seriously though, re offsite storage, one could encrypt all data locally and then offsite anywhere, right? Could be google drive for all you care.

Most thieves are smash-and-grab, and not smart or motivated enough to go seek out your NAS to take with them. Danny Ocean is not breaking into your house.

Besides, if the thieves were savvy enough to find and take your surveillance gear with them, they'd be unlikely to expose anything meaningful (like their faces) on your video feeds anyways, right?

Noob question: Is it possible to stream video to a device outside your WiFi without needing a third party server in the middle? How does one do that?

A VPN tunnel into your home network is one way, or a VPS you control that has a similar connection into your home network is another.

yes its possible, but a few things generate friction, major one is ISP based filtering.

often you have to use port forwrding to connect, on ports not recognized for protocols your ISP filters out.

You can own the server yourself. Ask a buddy if you can plug in a box in their garage, now you have an off site solution.

There are two ways to accomplish this: poke a hole in your home firewall and expose the camera feed to the entire open internet, then attempt to add some kind of authentication system. This is very very hard to get right, don’t do it. The other option is to tunnel your internet connection on the remote device back into your home network so it looks to your remote device like it’s still at home. That’s called a VPN.

Neither of these options are great, IMO. I'd prefer to have a proxy that transparently forwards e2e encrypted traffic with out of band key exchange. You can blast video over a 3rd party if you trust the software on either end to not leak your encryption keys. Sadly I think few services care much about this.

What kind of device? They make IP cams that push their stream to a preconfigured remote endpoint (with TLS). It would have to be a server on the public internet though, your phone probably wouldn’t work

Well I mostly use my security camera to watch my cat stretch. For this, I'm pretty happy with nest cams.

Well, look who's just made themselves a major target for hackers

they're going to see so many cat stretches

I just hope they follow the protocol of saying "big stretch" each time they see one

Reply on news.ycombinator.com