8 ms·

Xiaomi camera playing on Google home hub sends stills from other people's homes

234 points by palebluedot 7y ago

close04 7y ago
I have some cameras that are offline (no cloud integration, no internet connection) and when looking to buy a spare I noticed that all the newer and otherwise identical models only work with cloud integration. No ONVIF, no RTSP. Forcing the user's hand into sending all data into their cloud for very little convenience gained, if any.
deleted 7y ago
[deleted]
siffland 7y ago
This stuff gets me paranoid, i have a nest doorbell, because i don't care who can look at my front lawn, and a nest camera that only gets plugged in when no one is at the house. Other than that i have a closed circuit camera system with motioneyeos (motion activated) and a few POE cameras with no wifi and send the footage offsite. I know it is not as convenient, but these cameras are getting scary. These are only the stories we know about. imagine who else is watching.
- prox 7y ago
  You could probably create one yourself with a raspberry + camera, with added benefit you can mod it to make your own.
  - pmlnr 7y ago
    I've been on the hunt for a physical box that could house a raspi zero w with together with a power brick and a reasonably good wide angle lens to be an outdoor, weatherproof (not waterproof) camera that only needs a power cable. Adding motioneyeos on it would make a very decent hardware, but so far, nothing. If anyone knows something like this, a link would be appreciated.
    - vorpalhex 7y ago
      There are many, many 3d printable enclosures on thingiverse and elsewhere. I recommend still using a gasket and epoxying the enclosure.
    - patentatt 7y ago
      Seconded. Needs to have ~90 deg FOV, either good enough low-light performance or provisions for an IR emitter, option for a sound interface, POE, and put in a case that looks inconspicuous enough to hang on my wall in my home. AFAIK that doesn't exist and I wish it did. Being able to run an open source cctv system would be great, as the other option is typically running grey-market chinese non-upgradeable firmware.
    - wcarron 7y ago
      I don't have any pre-built recommendations, but you can figure out some dimensions and find someone online who'd be willing to 3D print it for you. Or you could find a machinist. That'll be fairly expensive, though. Lastly, you could probably make it using supplies from Home Depot, like PVC pipes + fittings and PVC cement, maybe some gasket sealer for any holes you drill. Probably the cheapest option of these 3.
    - michaelt 7y ago
      Option 1: search ebay (or a similar retailer) for "IP65 transparent" to find box-shaped waterproof enclosures with clear lids. Arrange electronics to your satisfaction, with the camera looking through the lid. Many sizes, but looks nothing like a normal CCTV camera. Option 2: Search for "CCTV housing" to find boxes that look like old-fashioned outdoor CCTV cameras. Fewer size choices, but less weird-looking.
    - longb4 7y ago
      My solution would be a fake birdhouse. It could be weatherproof and less conspicuous, and the hole on the front is a natural place to put a camera lens. (You might want to put a fake bird on top or something to dissuade actual birds.)
      - gnicholas 7y ago
- jannes 7y ago
  Why do you need an additional nest camera if you already have a CC camera system with ethernet cameras? (Genuinely curious, because I have neither of those)
  - siffland 7y ago
    My other half wanted the nest cameras, especially the doorbell one. She wanted to be able to check in real time when we are not at home if someone was at the door. I wanted camera's in the garage and back yard on at all times (people have wandered around the back yard before). Nest also costs per camera, so it would get expensive as well. So it was a variety of issues and it was a compromise i was willing, or maybe forced, to do. I am happy with just the closed camera system and sending footage offsite, alerts and logging on with my VPN if needed.
- tuxxy 7y ago
  > because i don't care who can look at my front lawn This is extremely selfish. What about your neighbors who walk/drive by your front lawn? You're doing your neighborhood a surveillance disservice.
  - CamperBob2 7y ago
    "Public" is a thing distinct from "private." On your property, you get to decide where the dividing line is. That's one of the primary ideas behind the notion of private property. The issue I have is when the property owner isn't told who has access to the resulting still images or video stream, or is actively deceived about it. I'd be reluctant to use a Ring camera at my front door for that reason, and there's no way on Earth I'd install anything like that inside my home.
    - lm28469 7y ago
      I'm pretty sure a lot, if not most, door cameras are filming public space.
      - CamperBob2 7y ago
        Yes, that's my point. I have a right to do that, and so do you, and so do Amazon, Google, and the CIA. See, that's the idea behind the word "public." Nobody has to ask user lm28469 on Hacker News for permission to take photos in public. This is a good thing.
        distances 7y ago
        Depends on jurisdiction. Dash cams are illegal in many countries.
        CamperBob2 7y ago
        True, only the police are allowed to run dash cams in those countries. We could also mention the trend toward berserk copyright laws that have much the same effect. [1] And these are not good things. Both communal and private interests end up worse off in the long run with laws like these. 1: https://www.asmp.org/copyright-tutorial/photos-public-buildings/ https://www.asmp.org/copyright-tutorial/photos-public-buildi...
- lambdadmitry 7y ago
  What I genuinely don't understand is why do you even need them. Do they somehow deter burglars? Unlikely, unless there is hard data showing that they do. Did the US somehow degenerate into a war zone lately, because everyone managed (and still manages outside the US!) to survive without those, but Americans suddenly need those cameras? Besides, what would you even do if a. you're away from your home b. a camera detects something c. you're near your phone at the moment (which isn't given at all, you're pretty likely to be asleep or busy)? Call the cops from the other side of the world and hope they come in time? Activate claymores or giant battle robots? How come Amazon and others apparently convinced millions of middle class Americans in the space of just a few years that they absolutely require 24/7 surveillance in and around their houses? Are you that scared of your compatriots? It's even more puzzling than gun worship tbh
  - chrisp_dc 7y ago
    I use my cameras to check in on my cat when I am out of town. Typically a friend only visits briefly once a day and I get peace of mind out of knowing that the cat is eating. If the cat was not eating, I'd ask a friend to take it to the vet or to sit with a while to make sure it eats.
    - lambdadmitry 7y ago
      Can't you just ask your friend to note if your cat ate during the day? I mean, they're probably refilling the bowls anyway, so they will notice if they're full Also the whole notion of an imminent danger for a semi-wild animal in a big house with daily renewed water and food is a bit weird to me. It seems like Amazon&co just amplify the existing irrational fears, don't you think so?
    - rconti 7y ago
      Ditto. I have 4 wyzecams I setup around the house when we go on vacation. Then I unplug them and put them in a box as soon as I return. And for Mr "Irrational fears", no, I do it for entertainment, not because BigEvilCorp taught me to be afraid.
olodus 7y ago
Since it only shows stills, could it be some kind of race condition? Don't get me wrong, the major problem is of course that it has access to other people's camera feeds but since it only gains access for what seems like a moment maybe the access getting denied is raced by the update of the screen? I don't know, why am I even thinking too deeply about this. A major company screwing up IoT. It happens way too often and there are a million ways they could do it.
- vesinisa 7y ago
  Probably a race condition. I once worked at a bank where the core banking system had a bug where if you asked account data for user X it would about once in a thousand queries return data for some unrelated user Y if the system was under a high load. The official, vendor-certified "fix" was that since the reply to this query contained the user ID, when calling this API you should always write a do-while loop like: do { accountsReply = bankCore.getAccountsForUser(myUserId) } while (accountsReply.userId != myUserId) This massive, embarrassing bug was not really documented anywhere, i.e. "silent information". You just "had to know" when writing code against this API that once in a blue moon, it could return data for the wrong user. But only in production, since the test environment was never under such heavy load it could trigger the race.
  - creeble 7y ago
    So, OT, but I wonder if this explains my recent atm withdrawal error on the part of wells fargo? A $300 atm, card-present withdrawal several hundred miles away (at a golf course country club) from where I had used the card less than an hour before. Skimmer + camera for pin is sort of the only other explanation, and I'm fairly paranoid about checking for skimmers.
    - ceejayoz 7y ago
      I've seen photos of some very convincing skimmers that I'd have no hope of detecting despite being pretty paranoid about them myself. Rooted point-of-sale devices are also a possibility - that's what led to the big Target hack.
jdhawk 7y ago
Stick with ONVIF cameras on a separate VLAN going to a recording platform like BlueIris, Zoneminder, Milestone, Synology.
dirtyid 7y ago
Google shutting down Xiaomi access to Assistant following Nest Hub picking up strangers' camera [1] >"We’re aware of the issue and are in contact with Xiaomi to work on a fix. In the meantime, we’re disabling Xiaomi integrations on our devices." ... >It appears Google isn't taking any chances when it comes to this issue, disabling Xiaomi integrations entirely. We reached out for further confirmation that this would mean a blanket disabling of all Mi Home products and were told that is the case. Pretty annoying they have to mess up all my other devices, but at least it's being addressed. [1] feedshttps://www.androidpolice.com/2020/01/02/uh-oh-xiaomi-camera-feed-showing-random-homes-on-a-google-nest-hub-including-still-images-of-sleeping-people/ https://www.androidpolice.com/2020/01/02/uh-oh-xiaomi-camera...
- krick 7y ago
  Huh. I'm not sure what should be the baseline of "okay" now anymore, but I wonder if this isn't worse than leaving things be. Leakage is out there anyway, and it seems likely now that it is buggy enough for malevolent actor to find a way to spy on his neighbour. But what about those who is away from home now and really needs the footage for some reason? I guess lack of this footage would be a bigger security issue for them than the chance a couple of frames will leak to somebody else.
  - dirtyid 7y ago
    The Xiaomi home app still works. Just no more google assistance for the time being
joshstrange 7y ago
Stories like this only confirm to me that while Zoneminder is far from perfect it was the better option for me compared to using consumer-grade options. I buy cheap ($40-$60) PoE cameras (I have some Reolink and 1-2 SV3C's I think), I immediately block their internet access by MAC address, then add them to ZoneMinder. I have 2 Wyze cameras as well but they are also only allowed to talk to ZoneMinder and I have flashed a custom firmware on them.

234 points by palebluedot 7y ago

I have some cameras that are offline (no cloud integration, no internet connection) and when looking to buy a spare I noticed that all the newer and otherwise identical models only work with cloud integration. No ONVIF, no RTSP. Forcing the user's hand into sending all data into their cloud for very little convenience gained, if any.

deleted 7y ago

[deleted]

siffland 7y ago

This stuff gets me paranoid, i have a nest doorbell, because i don't care who can look at my front lawn, and a nest camera that only gets plugged in when no one is at the house. Other than that i have a closed circuit camera system with motioneyeos (motion activated) and a few POE cameras with no wifi and send the footage offsite. I know it is not as convenient, but these cameras are getting scary. These are only the stories we know about. imagine who else is watching.

prox 7y ago
You could probably create one yourself with a raspberry + camera, with added benefit you can mod it to make your own.
- pmlnr 7y ago
  I've been on the hunt for a physical box that could house a raspi zero w with together with a power brick and a reasonably good wide angle lens to be an outdoor, weatherproof (not waterproof) camera that only needs a power cable. Adding motioneyeos on it would make a very decent hardware, but so far, nothing. If anyone knows something like this, a link would be appreciated.
  - vorpalhex 7y ago
    There are many, many 3d printable enclosures on thingiverse and elsewhere. I recommend still using a gasket and epoxying the enclosure.
  - patentatt 7y ago
    Seconded. Needs to have ~90 deg FOV, either good enough low-light performance or provisions for an IR emitter, option for a sound interface, POE, and put in a case that looks inconspicuous enough to hang on my wall in my home. AFAIK that doesn't exist and I wish it did. Being able to run an open source cctv system would be great, as the other option is typically running grey-market chinese non-upgradeable firmware.
  - wcarron 7y ago
    I don't have any pre-built recommendations, but you can figure out some dimensions and find someone online who'd be willing to 3D print it for you. Or you could find a machinist. That'll be fairly expensive, though. Lastly, you could probably make it using supplies from Home Depot, like PVC pipes + fittings and PVC cement, maybe some gasket sealer for any holes you drill. Probably the cheapest option of these 3.
  - michaelt 7y ago
    Option 1: search ebay (or a similar retailer) for "IP65 transparent" to find box-shaped waterproof enclosures with clear lids. Arrange electronics to your satisfaction, with the camera looking through the lid. Many sizes, but looks nothing like a normal CCTV camera. Option 2: Search for "CCTV housing" to find boxes that look like old-fashioned outdoor CCTV cameras. Fewer size choices, but less weird-looking.
  - longb4 7y ago
    My solution would be a fake birdhouse. It could be weatherproof and less conspicuous, and the hole on the front is a natural place to put a camera lens. (You might want to put a fake bird on top or something to dissuade actual birds.)
    - gnicholas 7y ago
jannes 7y ago
Why do you need an additional nest camera if you already have a CC camera system with ethernet cameras? (Genuinely curious, because I have neither of those)
- siffland 7y ago
  My other half wanted the nest cameras, especially the doorbell one. She wanted to be able to check in real time when we are not at home if someone was at the door. I wanted camera's in the garage and back yard on at all times (people have wandered around the back yard before). Nest also costs per camera, so it would get expensive as well. So it was a variety of issues and it was a compromise i was willing, or maybe forced, to do. I am happy with just the closed camera system and sending footage offsite, alerts and logging on with my VPN if needed.
tuxxy 7y ago
> because i don't care who can look at my front lawn This is extremely selfish. What about your neighbors who walk/drive by your front lawn? You're doing your neighborhood a surveillance disservice.
- CamperBob2 7y ago
  "Public" is a thing distinct from "private." On your property, you get to decide where the dividing line is. That's one of the primary ideas behind the notion of private property. The issue I have is when the property owner isn't told who has access to the resulting still images or video stream, or is actively deceived about it. I'd be reluctant to use a Ring camera at my front door for that reason, and there's no way on Earth I'd install anything like that inside my home.
  - lm28469 7y ago
    I'm pretty sure a lot, if not most, door cameras are filming public space.
    - CamperBob2 7y ago
      Yes, that's my point. I have a right to do that, and so do you, and so do Amazon, Google, and the CIA. See, that's the idea behind the word "public." Nobody has to ask user lm28469 on Hacker News for permission to take photos in public. This is a good thing.
      - distances 7y ago
        Depends on jurisdiction. Dash cams are illegal in many countries.
        CamperBob2 7y ago
        True, only the police are allowed to run dash cams in those countries. We could also mention the trend toward berserk copyright laws that have much the same effect. [1] And these are not good things. Both communal and private interests end up worse off in the long run with laws like these. 1: https://www.asmp.org/copyright-tutorial/photos-public-buildings/ https://www.asmp.org/copyright-tutorial/photos-public-buildi...
lambdadmitry 7y ago
What I genuinely don't understand is why do you even need them. Do they somehow deter burglars? Unlikely, unless there is hard data showing that they do. Did the US somehow degenerate into a war zone lately, because everyone managed (and still manages outside the US!) to survive without those, but Americans suddenly need those cameras? Besides, what would you even do if a. you're away from your home b. a camera detects something c. you're near your phone at the moment (which isn't given at all, you're pretty likely to be asleep or busy)? Call the cops from the other side of the world and hope they come in time? Activate claymores or giant battle robots? How come Amazon and others apparently convinced millions of middle class Americans in the space of just a few years that they absolutely require 24/7 surveillance in and around their houses? Are you that scared of your compatriots? It's even more puzzling than gun worship tbh
- chrisp_dc 7y ago
  I use my cameras to check in on my cat when I am out of town. Typically a friend only visits briefly once a day and I get peace of mind out of knowing that the cat is eating. If the cat was not eating, I'd ask a friend to take it to the vet or to sit with a while to make sure it eats.
  - lambdadmitry 7y ago
    Can't you just ask your friend to note if your cat ate during the day? I mean, they're probably refilling the bowls anyway, so they will notice if they're full Also the whole notion of an imminent danger for a semi-wild animal in a big house with daily renewed water and food is a bit weird to me. It seems like Amazon&co just amplify the existing irrational fears, don't you think so?
  - rconti 7y ago
    Ditto. I have 4 wyzecams I setup around the house when we go on vacation. Then I unplug them and put them in a box as soon as I return. And for Mr "Irrational fears", no, I do it for entertainment, not because BigEvilCorp taught me to be afraid.

olodus 7y ago

Since it only shows stills, could it be some kind of race condition? Don't get me wrong, the major problem is of course that it has access to other people's camera feeds but since it only gains access for what seems like a moment maybe the access getting denied is raced by the update of the screen? I don't know, why am I even thinking too deeply about this. A major company screwing up IoT. It happens way too often and there are a million ways they could do it.

vesinisa 7y ago
Probably a race condition. I once worked at a bank where the core banking system had a bug where if you asked account data for user X it would about once in a thousand queries return data for some unrelated user Y if the system was under a high load. The official, vendor-certified "fix" was that since the reply to this query contained the user ID, when calling this API you should always write a do-while loop like: do { accountsReply = bankCore.getAccountsForUser(myUserId) } while (accountsReply.userId != myUserId) This massive, embarrassing bug was not really documented anywhere, i.e. "silent information". You just "had to know" when writing code against this API that once in a blue moon, it could return data for the wrong user. But only in production, since the test environment was never under such heavy load it could trigger the race.
- creeble 7y ago
  So, OT, but I wonder if this explains my recent atm withdrawal error on the part of wells fargo? A $300 atm, card-present withdrawal several hundred miles away (at a golf course country club) from where I had used the card less than an hour before. Skimmer + camera for pin is sort of the only other explanation, and I'm fairly paranoid about checking for skimmers.
  - ceejayoz 7y ago
    I've seen photos of some very convincing skimmers that I'd have no hope of detecting despite being pretty paranoid about them myself. Rooted point-of-sale devices are also a possibility - that's what led to the big Target hack.

jdhawk 7y ago

Stick with ONVIF cameras on a separate VLAN going to a recording platform like BlueIris, Zoneminder, Milestone, Synology.

dirtyid 7y ago

Google shutting down Xiaomi access to Assistant following Nest Hub picking up strangers' camera [1] >"We’re aware of the issue and are in contact with Xiaomi to work on a fix. In the meantime, we’re disabling Xiaomi integrations on our devices." ... >It appears Google isn't taking any chances when it comes to this issue, disabling Xiaomi integrations entirely. We reached out for further confirmation that this would mean a blanket disabling of all Mi Home products and were told that is the case. Pretty annoying they have to mess up all my other devices, but at least it's being addressed. [1] feedshttps://www.androidpolice.com/2020/01/02/uh-oh-xiaomi-camera-feed-showing-random-homes-on-a-google-nest-hub-including-still-images-of-sleeping-people/ https://www.androidpolice.com/2020/01/02/uh-oh-xiaomi-camera...

krick 7y ago
Huh. I'm not sure what should be the baseline of "okay" now anymore, but I wonder if this isn't worse than leaving things be. Leakage is out there anyway, and it seems likely now that it is buggy enough for malevolent actor to find a way to spy on his neighbour. But what about those who is away from home now and really needs the footage for some reason? I guess lack of this footage would be a bigger security issue for them than the chance a couple of frames will leak to somebody else.
- dirtyid 7y ago
  The Xiaomi home app still works. Just no more google assistance for the time being

joshstrange 7y ago

Stories like this only confirm to me that while Zoneminder is far from perfect it was the better option for me compared to using consumer-grade options. I buy cheap ($40-$60) PoE cameras (I have some Reolink and 1-2 SV3C's I think), I immediately block their internet access by MAC address, then add them to ZoneMinder. I have 2 Wyze cameras as well but they are also only allowed to talk to ZoneMinder and I have flashed a custom firmware on them.