11 ms·

For Owners of Ring Security Cameras, Strangers May Have Been Watching Too

106 points by Deinos 8y ago

pizza 8y ago
By the way, how are privacy-minded HNers monitoring their homes? Going with Ring (or similar) or more traditional alarm services?
- guscost 8y ago
  I put up a SimpliSafe system at my house, and it's pretty nice overall. There's a security camera included, but it has a physical shutter that opens with an audible "click" whenever the feed is on. I'm a bit too lazy to be "privacy-minded" but it's a nice touch.
- StavrosK 8y ago
  I got a Xiaomi Dafang camera and flashed it with OSS firmware, and all such devices in my network have no access to the internet or to other devices. I connect to them from the outside through an authenticated HTTP proxy (or WireGuard).
- nickthegreek 8y ago
  I used to just use a bunch of Foscam's but I recently moved to Canary for the auto arming and push notifications. Here is their security page. https://canary.is/security/ https://canary.is/security/
- ASalazarMX 8y ago
  A Dahua DVR with wired cameras. Dahua has a free and painless P2P connection service that lets you view the DVR from the Internet without exposing a port in your router. I'm not entirely at ease with using a cloud service, but I'm way less comfortable with directly exposing the DVR's access directly to the Internet.
- Mister_Snuggles 8y ago
  I use Blue Iris and a variety of cheap cameras that I've acquired over the years. Remote access is done via an IPSec VPN. I also use Home Assistant and various other devices to monitor other things in the house - temperature (since freezing water pipes is a concern), water level in the sump, etc. I don't do anything with alerting yet, but there are many ways to solve this. Having a next door neighbour who's retired and really good at spotting when things are out of the ordinary helps too.
- beat 8y ago
  Two large, loud dogs. edit: Before I get a bunch of downvote nonsense, this is a serious answer. Dogs (especially big ones that bark when excited) are terrific home protection. No intruder is going to risk a tussle with a couple of big dogs hell-bent on protecting their home. Plus they're totally good with people they already know and trust arriving, even if we aren't there. All a camera will do is record the fact that you're being robbed.
  - mikestew 8y ago
    I believe that has been advice in lieu of security systems for decades. That metal front gate opens, the giant head of that pit bull/mastiff mix pops up with a "woof", and no one has to know that a piece of cheese would allow you slip right past him. I didn't get him for "protection", the dog needed a home and no one else was taking him. But his size and looks do have their perks. Didn't Myth Busters do a show on how a piece of steak will get you past all but specifically-trained guard dogs? The only danger one would face with our dogs is getting knocked down while they try and get the steak.
    - beat 8y ago
      Sure, if someone is really determined to get past guard dogs, they can. But a casual burglar isn't going to bother. One of mine is 95 pounds of black lab/german shepherd mutt with a massive baritone bark, but he's totally harmless, except for maybe knocking you over. The other one is 35 pounds and so cute that people assume he's a she, but he's actually bitten at least three different people while overprotecting the house and yard, and I have no doubt he'd die fighting. (And the new next door neighbor learned what he already knew, which was to not stick your hand over the fence to pet the barking dog who doesn't know you and is very concerned that you're in the yard of his friends, even when that dog is small and cute.)
      - rhizome 8y ago
        What proportion of burglaries are committed by "casual" perpetrators? Steak is cheap.
      - 8y ago
- deaps 8y ago
  I have an RCA doorbell camera. It stores locally on the included card (can upgrade this if you want). Then I can watch the videos through my phone (which connects to the camera to read the internal storage). On the app itself, there is room for 4 total cameras. I've considered adding another camera (RCA has a few non-doorbell ones also). My main concern wasn't security (this is outside my house) anyway, but it was that I didn't want another monthly charge for something.
- tptacek 8y ago
  We've got some Nest outdoor cameras on our front door, back yard, and alley-facing garage.
- mulmen 8y ago
  The same way people have for centuries. There’s a lock on the door. More generally I protect myself (including my privacy) by not living in a constant state of fear.
userbinator 8y ago
I've never understood why people seem to love these surveillance devices that rely on an external service. Besides the privacy issues, if the service disappears or even the Internet connection goes down, they become useless. A DVR and a set of "old school" network cameras in an internal network have none of those problems, but it seems all the big companies are eagerly pushing "cloud" centralisation instead of making easy-to-use local solutions.
- jbob2000 8y ago
  > A DVR and a set of "old school" network cameras in an internal network have none of those problems Ring is a $300 purchase and takes an hour to install. This would take me a few weekends and would cost thousands of dollars. Cloud centralization makes things easier and cheaper, by orders of magnitude.
  - e1ven 8y ago
    Why would it be so difficult to connect to locally? A company could drop a camera and a small NAS box, and have it all work over the local WiFi. I haven't looked into it, but I suspect there are several vendors who already do this. It would get more complicated to support accessing it while away from home, admittedly. I don't know if that's an important feature for this application.
    - ASalazarMX 8y ago
      > It would get more complicated to support accessing it while away from home, admittedly. I don't know if that's an important feature for this application. That's the killer feature. What good is a home surveillance system if you have to be there to use it?
      - cordonbleu 8y ago
        i can drop a link right now that will let you look around at my driveway, if i get to know you better i could give you a login so you can see it works.
dclusin 8y ago
Any thoughts on how hard would it be to cobble something together using COTS cameras and a FOSS web portal? All I'd really want is a few camera feeds with some tagging when motion is detected. I feel like use case covers most of why people get them.
- deleted 8y ago
  [deleted]
- rufugee 8y ago
  Look at https://zoneminder.com/ https://zoneminder.com/. I used it successfully to do what you ask for at a fraction of the cost of cloud cameras. The only reason I switched to Ring/Arlo was for 2-way audio and the ability to have battery-powered cameras. ZM was really nice to work with.
  - bradknowles 8y ago
    Try Shinobi (see https://moeiscool.github.io/Shinobi/ https://moeiscool.github.io/Shinobi/).
stcredzero 8y ago
Jeez. One of the first cybersecurity presentations I went to was in the early 2000's. Someone consulting for the newly minted Homeland Security was talking about intercepting feeds from unsecured video cameras. This is the progress we can make in a decade and a half?
michaelchisari 8y ago
the video files were left unencrypted, the source said, because of Ring leadership’s “sense that encryption would make the company less valuable,” owing to the expense of implementing encryption and lost revenue opportunities due to restricted access. This is an industry problem, and a big one.
- partiallypro 8y ago
  To be fair (but not really) they still cashed out for a billion dollars, so I guess they were right about the money.
  - atomical 8y ago
    How does that prove that they were right about their stance on encryption?
    - Waterluvian 8y ago
      That if their goal is to cash out then it didn't matter to bother. Or maybe, that it's possible to dodge a bullet of their own stupidity and still successfully cash out.
      - atomical 8y ago
        That doesn't make sense at all. A fiasco before cashing out would cause a crisis.
- trumped 8y ago
  of course they don't want end-to-end encryption because then they won't be able to look at your data...
annefauvre 8y ago
Ring has cut a lot of corners to get to market quickly. I don't think this is the last time we'll hear of these types of issues from them (or the other small hardware co's)
ocdtrekkie 8y ago
This is why I'm writing my own home automation system that runs entirely on premises. It's too private of a space to entrust to anyone else.
- EricE 8y ago
  Why? There's plenty of open source stuff like https://www.home-assistant.io https://www.home-assistant.io out there.
mimixco 8y ago
The founder of Ring was back on Shark Tank as a shark himself not long ago. It's interesting to see how his perspective has changed since joining Amazon. He invented the product so he could hear/see the doorbell from his garage. But now he presents himself as some kind of social crusader, out to protect the world. It's disturbing to see how many big tech companies have turned into surveillance and military companies lately.
- president 8y ago
  > But now he presents himself as some kind of social crusader, out to protect the world. So many tech CEOs do this. It's a cop-out method of rebranding one's image. In reality though, it says more about the public at large for believing into marketing and PR.
  - cwkoss 8y ago
    When someone markets themselves as "good", they are usually trying to distract you from something not so good that they are doing.
  - e40 8y ago
    This is why I stopped watching Shark Tank. It started out interesting, but the last couple of years have been all PR and BS. I stopped watching the second Sir Richard Branson threw water in Mark Cuban's face. Shark Tank had jumped the shark.
    - mimixco 8y ago
      Is it just me, or is Daymond John especially mean to black entrepreneurs who haven't "made it" yet? Did you see the one with the African fashion company where he told the gal he couldn't be involved because he might be sued? Over clothing? I have noticed that over the years they've moved from supporting small entrepreneurs who are just starting out to only funding companies that already have proven success. You used to be insane to ask for a $1M valuation (or a $1M investment) on that show; now, it happens every week.
babypuncher 8y ago
Does anyone know of a similar product and service that offers end-to-end encryption?
_711o 8y ago
local police districts are pushing these devices on residences unaware with how this citizen video data is processed or handled in Ukraine. Aside from the 700 person team given access to live video feeds and customer databases, the lack of proper security of this product makes it a PRIME target for DDOS attacks that could cripple infrastructure.
EricE 8y ago
Cloud cameras are beyond stupid.
EricE 8y ago
Camera systems with 100% local storage and drop dead simple remote access do exist. For example - Unifi Protect. NVR: https://store.ubnt.com/collections/surveillance/products/unifi-cloudkey-gen2-plus-1 https://store.ubnt.com/collections/surveillance/products/uni... $200, rated to support 20 cameras - some use more with no problems. Pretty nice box. 8 core ARM, 3GB of RAM, 1TB hard drive, POE powered, built in battery backup for clean system shutdown. Well made, metal case feels like a piece of Apple kit. https://store.ubnt.com/collections/surveillance/products/unifi-video-g3-flex-camera-1 https://store.ubnt.com/collections/surveillance/products/uni... $80. They have others in the $150 - $250 range depending on capabilities. They even have a wifi one, but wired is always better. $100 switch gives you four POE ports - the DVR and three cameras: https://store.ubnt.com/collections/routing-switching/products/unifi-switch-8-60w https://store.ubnt.com/collections/routing-switching/product... There are other switches that can provide more POE ports if you need 'em. Pretty decent system. No monthly fees - slightly higher up front cost will pay for itself over time, especially if you have more than one or two cameras. What's really nice about their system? Create a free account with them. Set up the NVR and log it into the free account. Load their app on your phone, log into the account and boom. You have access. Whether you are remote or not. Their cloud service brokers the connection from your device to your phone. No firewall ports to forward or other configurations. NVR connects to cloud, uses that connect your remote access back to the NVR. Slick as snot. Once you connect their cloud is out of the equation. There might be other vendors with solutions as easy to use and set up - I haven't found them. I sure as hell don't need to store my video in the cloud.
eeeeeeeeeeeee 8y ago
Has anyone done a deep dive regarding security on the Nest cameras? I’ve been holding off getting one for this exact fear that has come true for Ring users.

106 points by Deinos 8y ago

By the way, how are privacy-minded HNers monitoring their homes? Going with Ring (or similar) or more traditional alarm services?

guscost 8y ago
I put up a SimpliSafe system at my house, and it's pretty nice overall. There's a security camera included, but it has a physical shutter that opens with an audible "click" whenever the feed is on. I'm a bit too lazy to be "privacy-minded" but it's a nice touch.
StavrosK 8y ago
I got a Xiaomi Dafang camera and flashed it with OSS firmware, and all such devices in my network have no access to the internet or to other devices. I connect to them from the outside through an authenticated HTTP proxy (or WireGuard).
nickthegreek 8y ago
I used to just use a bunch of Foscam's but I recently moved to Canary for the auto arming and push notifications. Here is their security page. https://canary.is/security/ https://canary.is/security/
ASalazarMX 8y ago
A Dahua DVR with wired cameras. Dahua has a free and painless P2P connection service that lets you view the DVR from the Internet without exposing a port in your router. I'm not entirely at ease with using a cloud service, but I'm way less comfortable with directly exposing the DVR's access directly to the Internet.
Mister_Snuggles 8y ago
I use Blue Iris and a variety of cheap cameras that I've acquired over the years. Remote access is done via an IPSec VPN. I also use Home Assistant and various other devices to monitor other things in the house - temperature (since freezing water pipes is a concern), water level in the sump, etc. I don't do anything with alerting yet, but there are many ways to solve this. Having a next door neighbour who's retired and really good at spotting when things are out of the ordinary helps too.
beat 8y ago
Two large, loud dogs. edit: Before I get a bunch of downvote nonsense, this is a serious answer. Dogs (especially big ones that bark when excited) are terrific home protection. No intruder is going to risk a tussle with a couple of big dogs hell-bent on protecting their home. Plus they're totally good with people they already know and trust arriving, even if we aren't there. All a camera will do is record the fact that you're being robbed.
- mikestew 8y ago
  I believe that has been advice in lieu of security systems for decades. That metal front gate opens, the giant head of that pit bull/mastiff mix pops up with a "woof", and no one has to know that a piece of cheese would allow you slip right past him. I didn't get him for "protection", the dog needed a home and no one else was taking him. But his size and looks do have their perks. Didn't Myth Busters do a show on how a piece of steak will get you past all but specifically-trained guard dogs? The only danger one would face with our dogs is getting knocked down while they try and get the steak.
  - beat 8y ago
    Sure, if someone is really determined to get past guard dogs, they can. But a casual burglar isn't going to bother. One of mine is 95 pounds of black lab/german shepherd mutt with a massive baritone bark, but he's totally harmless, except for maybe knocking you over. The other one is 35 pounds and so cute that people assume he's a she, but he's actually bitten at least three different people while overprotecting the house and yard, and I have no doubt he'd die fighting. (And the new next door neighbor learned what he already knew, which was to not stick your hand over the fence to pet the barking dog who doesn't know you and is very concerned that you're in the yard of his friends, even when that dog is small and cute.)
    - rhizome 8y ago
      What proportion of burglaries are committed by "casual" perpetrators? Steak is cheap.
    - 8y ago
deaps 8y ago
I have an RCA doorbell camera. It stores locally on the included card (can upgrade this if you want). Then I can watch the videos through my phone (which connects to the camera to read the internal storage). On the app itself, there is room for 4 total cameras. I've considered adding another camera (RCA has a few non-doorbell ones also). My main concern wasn't security (this is outside my house) anyway, but it was that I didn't want another monthly charge for something.
tptacek 8y ago
We've got some Nest outdoor cameras on our front door, back yard, and alley-facing garage.
mulmen 8y ago
The same way people have for centuries. There’s a lock on the door. More generally I protect myself (including my privacy) by not living in a constant state of fear.

userbinator 8y ago

I've never understood why people seem to love these surveillance devices that rely on an external service. Besides the privacy issues, if the service disappears or even the Internet connection goes down, they become useless. A DVR and a set of "old school" network cameras in an internal network have none of those problems, but it seems all the big companies are eagerly pushing "cloud" centralisation instead of making easy-to-use local solutions.

jbob2000 8y ago
> A DVR and a set of "old school" network cameras in an internal network have none of those problems Ring is a $300 purchase and takes an hour to install. This would take me a few weekends and would cost thousands of dollars. Cloud centralization makes things easier and cheaper, by orders of magnitude.
- e1ven 8y ago
  Why would it be so difficult to connect to locally? A company could drop a camera and a small NAS box, and have it all work over the local WiFi. I haven't looked into it, but I suspect there are several vendors who already do this. It would get more complicated to support accessing it while away from home, admittedly. I don't know if that's an important feature for this application.
  - ASalazarMX 8y ago
    > It would get more complicated to support accessing it while away from home, admittedly. I don't know if that's an important feature for this application. That's the killer feature. What good is a home surveillance system if you have to be there to use it?
    - cordonbleu 8y ago
      i can drop a link right now that will let you look around at my driveway, if i get to know you better i could give you a login so you can see it works.

dclusin 8y ago

Any thoughts on how hard would it be to cobble something together using COTS cameras and a FOSS web portal? All I'd really want is a few camera feeds with some tagging when motion is detected. I feel like use case covers most of why people get them.

deleted 8y ago
[deleted]
rufugee 8y ago
Look at https://zoneminder.com/ https://zoneminder.com/. I used it successfully to do what you ask for at a fraction of the cost of cloud cameras. The only reason I switched to Ring/Arlo was for 2-way audio and the ability to have battery-powered cameras. ZM was really nice to work with.
- bradknowles 8y ago
  Try Shinobi (see https://moeiscool.github.io/Shinobi/ https://moeiscool.github.io/Shinobi/).

stcredzero 8y ago

Jeez. One of the first cybersecurity presentations I went to was in the early 2000's. Someone consulting for the newly minted Homeland Security was talking about intercepting feeds from unsecured video cameras. This is the progress we can make in a decade and a half?

michaelchisari 8y ago

the video files were left unencrypted, the source said, because of Ring leadership’s “sense that encryption would make the company less valuable,” owing to the expense of implementing encryption and lost revenue opportunities due to restricted access. This is an industry problem, and a big one.

partiallypro 8y ago
To be fair (but not really) they still cashed out for a billion dollars, so I guess they were right about the money.
- atomical 8y ago
  How does that prove that they were right about their stance on encryption?
  - Waterluvian 8y ago
    That if their goal is to cash out then it didn't matter to bother. Or maybe, that it's possible to dodge a bullet of their own stupidity and still successfully cash out.
    - atomical 8y ago
      That doesn't make sense at all. A fiasco before cashing out would cause a crisis.
trumped 8y ago
of course they don't want end-to-end encryption because then they won't be able to look at your data...

annefauvre 8y ago

Ring has cut a lot of corners to get to market quickly. I don't think this is the last time we'll hear of these types of issues from them (or the other small hardware co's)

ocdtrekkie 8y ago

This is why I'm writing my own home automation system that runs entirely on premises. It's too private of a space to entrust to anyone else.

EricE 8y ago
Why? There's plenty of open source stuff like https://www.home-assistant.io https://www.home-assistant.io out there.

mimixco 8y ago

The founder of Ring was back on Shark Tank as a shark himself not long ago. It's interesting to see how his perspective has changed since joining Amazon. He invented the product so he could hear/see the doorbell from his garage. But now he presents himself as some kind of social crusader, out to protect the world. It's disturbing to see how many big tech companies have turned into surveillance and military companies lately.

president 8y ago
> But now he presents himself as some kind of social crusader, out to protect the world. So many tech CEOs do this. It's a cop-out method of rebranding one's image. In reality though, it says more about the public at large for believing into marketing and PR.
- cwkoss 8y ago
  When someone markets themselves as "good", they are usually trying to distract you from something not so good that they are doing.
- e40 8y ago
  This is why I stopped watching Shark Tank. It started out interesting, but the last couple of years have been all PR and BS. I stopped watching the second Sir Richard Branson threw water in Mark Cuban's face. Shark Tank had jumped the shark.
  - mimixco 8y ago
    Is it just me, or is Daymond John especially mean to black entrepreneurs who haven't "made it" yet? Did you see the one with the African fashion company where he told the gal he couldn't be involved because he might be sued? Over clothing? I have noticed that over the years they've moved from supporting small entrepreneurs who are just starting out to only funding companies that already have proven success. You used to be insane to ask for a $1M valuation (or a $1M investment) on that show; now, it happens every week.

babypuncher 8y ago

Does anyone know of a similar product and service that offers end-to-end encryption?

_711o 8y ago

local police districts are pushing these devices on residences unaware with how this citizen video data is processed or handled in Ukraine. Aside from the 700 person team given access to live video feeds and customer databases, the lack of proper security of this product makes it a PRIME target for DDOS attacks that could cripple infrastructure.

EricE 8y ago

Cloud cameras are beyond stupid.

EricE 8y ago

Camera systems with 100% local storage and drop dead simple remote access do exist. For example - Unifi Protect. NVR: https://store.ubnt.com/collections/surveillance/products/unifi-cloudkey-gen2-plus-1 https://store.ubnt.com/collections/surveillance/products/uni... $200, rated to support 20 cameras - some use more with no problems. Pretty nice box. 8 core ARM, 3GB of RAM, 1TB hard drive, POE powered, built in battery backup for clean system shutdown. Well made, metal case feels like a piece of Apple kit. https://store.ubnt.com/collections/surveillance/products/unifi-video-g3-flex-camera-1 https://store.ubnt.com/collections/surveillance/products/uni... $80. They have others in the $150 - $250 range depending on capabilities. They even have a wifi one, but wired is always better. $100 switch gives you four POE ports - the DVR and three cameras: https://store.ubnt.com/collections/routing-switching/products/unifi-switch-8-60w https://store.ubnt.com/collections/routing-switching/product... There are other switches that can provide more POE ports if you need 'em. Pretty decent system. No monthly fees - slightly higher up front cost will pay for itself over time, especially if you have more than one or two cameras. What's really nice about their system? Create a free account with them. Set up the NVR and log it into the free account. Load their app on your phone, log into the account and boom. You have access. Whether you are remote or not. Their cloud service brokers the connection from your device to your phone. No firewall ports to forward or other configurations. NVR connects to cloud, uses that connect your remote access back to the NVR. Slick as snot. Once you connect their cloud is out of the equation. There might be other vendors with solutions as easy to use and set up - I haven't found them. I sure as hell don't need to store my video in the cloud.

eeeeeeeeeeeee 8y ago

Has anyone done a deep dive regarding security on the Nest cameras? I’ve been holding off getting one for this exact fear that has come true for Ring users.