12 ms·

Putting surveillance video on the cloud is... kinda dumb. It's rarely viewed outside your network, and local drives cost drastically less than the bandwidth nee

Putting surveillance video on the cloud is... kinda dumb. It's rarely viewed outside your network, and local drives cost drastically less than the bandwidth needs. Also it's incredibly sensitive data that shouldn't leave your network without really good reason anyways. The solution to this hack is simple: Shut this company down, because it's a bad idea.

_-david-_ 6y ago
I think the biggest selling point to cloud security cameras is to have a copy of the video not at the location. If your house / business is robbed or burns down you will possibly lose the video. This video could be used to find the theif or arsonist. Ideally it would store video locally, then encrypt it and upload the last minute to the cloud.
- ocdtrekkie 6y ago
  Plausibly, yes, though again, large enterprises should be able to handle this internally, especially some of the listed customers here.
  - zerkten 6y ago
    There are plenty of use cases, such as the various forms of analysis with ML, which are often only implemented outside the "company firewall" (this idea is antiquated.) Of course, this could and should be handled inside a trusted boundary (I can't think of a better term for today's networks), but in practice security here is fairly immature and people try things when there isn't good governance in place.
    - TeMPOraL 6y ago
      This sounds like general problem of enterprise security. There are no consequences. I can entirely get why a company would outsource IP cameras to a third party cloud, even with storing data on-site. Business runs on contracts. It's entirely normal to contract out everything except your core competencies, if it's cheaper this way. It's how you turn CAPEX, complex OPEX and high risk into simple OPEX and low risk. A contract is in big part a risk shifting tool. This works well in practice... outside IT. The problem is, with IT and data, there's a mismatch between expectations and reality. An enterprise should feel safe buying their video surveillance from Verkada, because between the contract and the legal framework, Verkada should be bankrupt now, and their management possibly facing jail time. That's the part where contracts work as Cover-Your-Ass tool: if you shift risk and liability to outside party, the liability is not on you. However, this only works as long as the other party actually internalizes the risk and liability. Since there are no consequences for mishandling data, operating IT services you're not structurally competent to operate, and eventually having your crown jewels stolen - the contractor doesn't really internalize risk, has no incentive to mitigate it. All this to say: Verkada should go down after this, and their customers should be named and shamed widely - the latter is so that future customers of IT services put more care into vetting companies they contract IT out to. You shouldn't get to CYA with a contract where assumptions around contracting are broken.
  - AmericanChopper 6y ago
    I work in a large enterprise. If my employer were to decide to exclusively store security footage on our own infrastructure, then I would have access to every piece of hardware it’s stored on. The risks associated with that is why every piece of mission critical data where I work is, at a minimum, backed up in a 3rd party facility.
- nielsbot 6y ago
  Also, convenience: Buy this camera, get access to recordings anywhere over the internet with nearly zero setup time. If you have an on-site system (like I do) it's way more effort for the average consumer.
  - andrewprock 6y ago
    That's not security, that's voyeurism
    - vincnetas 6y ago
      Was also thinking the same. Security cameras should be used where there is an incident and additional information is needed to clarify what happened. Then you check the security camera footage to figure out what happened. If there were no incidents there is not reasonable need for anyone to look at that footage. edit: not talking here about active monitoring security cameras used by guards.
- ma2rten 6y ago
  Another one is that you can run machine learning on it. For example to automatically detect unusual activity.
  - ocdtrekkie 6y ago
    You can absolutely run machine learning on-premise hardware.
- brk 6y ago
  The biggest selling point is really the OPEX sales model, and outsourcing of the general care-and-feeding of the recorders/servers. The tradeoff is that you tend to get lesser quality video and/or less scalability of the size of the system from bandwidth limitations. Theft of recorders/loss of recorded video is much much less of an issue than it is generally made out to be, and most systems have various means for auto backups, dual recording, etc. Many also have the ability to send select segments of video, based on motion or analytics, to cloud/FTP/email for free, which adds some extra resiliency if you are really worried about random arsonists :) (I work in the industry)
  - pdimitar 6y ago
    > (I work in the industry) Ohhhh, you are so in trouble now! :P I am pondering moving to a rather remote estate with my wife but we're both city kids and have zero clue how to defend ourselves in such conditions (I am even thinking we should take shooting lessons and bring guns to the estate as well). Part of our plan is a surveillance system -- I planned to have an on-site ZFS storage cluster with several cameras that periodically encrypts the last 5 minutes and sends them off-site. Not sure how complex such a setup might turn out to be though... Maybe there's a way to make the storage cluster itself auto-replicate remotely often enough? I'm not that educated yet. Do you have any recommendations? I don't want to spend $5000 due to paranoia but I don't want to be defenseless in case of a robbery either. What's the middle ground?
    - brk 6y ago
      This isn't a short conversation, but you can contact me offline and I can give you some pointers.
      - pdimitar 6y ago
        Pinged you on twitter several hours ago, as I can't find any other accounts in your HN profile and don't want to stalk by looking you up online.
    - bigbillheck 6y ago
bsder 6y ago
> Putting surveillance video on the cloud is... kinda dumb. I tend to agree, but ... If you're a small business or manufacturer, IT is a pain in the ass. The "cloud" is a benefit because you don't need to maintain any servers yourself and can just get on with your business. The problem is that these companies don't face any consequence for claiming that they're secure and then not actually being ... you know ... secure. If this stuff was simply encrypted at rest, that would have mitigated most of this breach.
- ocdtrekkie 6y ago
  Sure, but many of Verkada's customers are large enterprises with large IT teams just making a bad decision. Small businesses have either a box they bought at Costco or use something like Comcast's service which they just add on to their cable modem.
  - leesalminen 6y ago
    Those boxes from Costco come with WiFi built in and a mobile app paired to it. The small business owner invariably sets up port forwarding so they can watch from home and leaves the default password because it doesn’t force you to change it. Not much better there either.
    - ocdtrekkie 6y ago
      My point was less that those were good solutions, but that a company I contend "shouldn't exist" likely has a different customer segment, like Tesla and Cloudflare.
    - intrasight 6y ago
      Oh, the places I've boldly gone - using default passcodes
- brundolf 6y ago
  I don't think it would, because they leaked admin credentials (unless it was encrypted with a customer key and inaccessible to admin/support) Anyway, I think we're at the point with software/digital systems where food manufacturing was in 1900: there's been a gold-rush due to new technology, and we're reaching peak negligence in the pursuit of profit, and I think we'll soon get to a threshold where regulators will finally step in and lock down the wild-west and impose some real standards. Between SolarWinds, Exchange, and now this, it's to a point where it's dragging down our whole society. Something has to give.
Hnaomyiph 6y ago
It's amazing how much security people and companies are willing to give up for a smidge of convenience. Properly deployed CCTV has little worry of hackers since, hence it's name, it is closed-circuit.
- lancesells 6y ago
  This made me wonder if there's a place for a company to disrupt the video cloud industry by selling CCTV cameras and devices that would require physical updates sent on a usb drive.
  - ocdtrekkie 6y ago
    It's not actually hard to do that today with existing equipment: Put it all on a network switch and then just... don't plug it into the Internet. Plenty of on-premise solutions exist and work with or without remote connectivity.
  - vel0city 6y ago
    Get this: closed circuit television systems actually existed before updates could be delivered by the internet. Another crazy fact: there are still products sold which don't connect to the internet. You don't see nearly as many ads on these products though and don't seem to be as popular these days.
- pugworthy 6y ago
  Trust me, it's not always about convenience for some of us remote camera users. In my case, I've got a camera in my elderly parent's back yard as there have been a few falls in the back yard, and one break-in some years back.
  - stjohnswarts 6y ago
    That seems like more trouble than it's worth though. Do you like just check every hour to see if someone has fallen or something? That seems like something that could become either an obsession or something you'd forget to do.
passivate 6y ago
Ouch! That's a bit harsh! Well, I suppose cloud archives could be encrypted? We use a cloud based system (but no cloud backup) and with multiple facilities, its nice to be able to launch the app and stream the camera's live feed using the cloud as a bounce. Also with the cloud being used as the de-facto off-site backup location, most data these days will end-up (hopefully encrypted) in some kind of cloud service or another.
- ocdtrekkie 6y ago
  Remote access is fine, it can be reasonably managed: Generally the client sets it, and the manufacturer doesn't retain access. Usually you can geoblock and such as well. You have control of the hardware and can implement encrypted storage and better access controls, rather than trusting a third party to decide what is "secure".
bredren 6y ago
This would be a much bigger hack if it were Wyze. Wyze cams are generally placed in residential interiors and contain a mic that can not be disconnected without physical removal. It wouldn’t be as newsy, though because people put these in their own homes. The only way this group raises awareness instead of angering people is by targeting companies and institutions, rather than forcing people to confront their own compromises with technology, time and effort.
- tkinom 6y ago
  Any known security issue with Wyze? I am very impress with their features. I am planning to buy couple of them, but I would never point them inside the house. Probably will put them in their own wifi network. I built a home grow solution with RPi + Webcam + Google Drive with some python script. But the performance to upload Pics to G Drive was slow and the way viewing the pics uploaded to G Drive was not very convenient.
  - GloriousKoji 6y ago
    If you're serious about security I recommend against wyze. You're locked into their platform and it isn't fully reliable. If you want something like a video of that opossum sneaking in the attic, coyote peeing in your rose bushes, that kid across in the street with the razer scooter and german shepard not cleaning up the poop off your lawn or what your iguana is up to when you're not home then it's great for that. The UI is probably worse than your gdrive setup. You have to use the wyze app to access it, which has a terribly slow scrubbing interface. The more convenient part is to check the motion/sound triggered 15 second clips which are upload to their cloud servers. Other than that I find myself frustrated and just take out the microSD card and browse it on my computer. Also don't buy the sense kit. It just doesn't work. I've even tried experiments with it right next to the camera and it's not consistent enough. If you want to use the wyze cams are generic IP cameras they offer unsupported firmware for that but then you'll need to roll your own DVR and I'm not sure if that supports all the new features the V3 offers or follows the genric protocol for remote pan control.
    - 6y ago
tomc1985 6y ago
But then how will techbro wantrepreneurs build their unicorn business?!?!
Spooky23 6y ago
For anything small, the local drives are obvious theft targets. For anything large or distributed, you’re probably going to spend less for better security with a cloud system. It’s sensitive data, but probably in a second tier of sensitivity. The integrity of the on-prem system depends in your remote access security and operational practices. Solutions like this often really suck.
pugworthy 6y ago
> Putting surveillance video on the cloud is... kinda dumb It's a necessity for some cases. I commented on this elsewhere, but for me it's having an eye on my elderly parents back yard in case of falls. Past history of not knowing is precisely why we got the camera.
- ronnier 6y ago
  You can still keep them local and use a VPN. That's what I do.
  - contravariant 6y ago
    People really should. It's pretty easy these days with wireguard or tailscale. Just plug a raspberry pi somewhere with network and power and you're set.
    - pugworthy 6y ago
      I spend my day doing the "tech shit" for work. I don't want to mess with stuff, I just want it to work. I'm willing to risk a bit of security for it to "just work", which it has now for multiple years. Without any security issues (so far).
      - contravariant 6y ago
        I completely agree, even though I do tinker around with stuff for fun. However in my experience so far wireguard and tailscale (which is based on wireguard) are the kind of solutions that just work with little to no oversight.
  - SilverRed 6y ago
    Its still on the internet though. Its just the VPN becomes the security barrier. Although if you keep it up to date, its going to be safer than iot crap
mike_d 6y ago
> It's rarely viewed outside your network The majority of real camera systems (100+ cameras, 10+ locations) I have interacted with are monitored by outside vendors.
quasirandom 6y ago
There's more information here as well. Cloudflare was apparently operating network connected facial recognition cameras in their offices. I'm not someone who's crazy about privacy, but this is a pretty dark indicator for a company housing DNS query records. Maybe its time for someone to build a proxy for tunneling Cloudflare DoH/DoT over tor or some other free mixing network.
- bradlys 6y ago
  How is that something to be worried about? There are companies out there that try to monitor if employees are in rooms/areas that they're not supposed to be. You can do that with badges/RFID but then people can take a card or slide by in various ways. (Happens all the time at big companies - people just tailgate) If anything, they might be taking privacy more seriously by not letting people without authorized access into secure areas. I think you give up any sense of privacy as to where you're located in an office or where you've been in an office when you decide to work in an office owned by some employer. I don't know why there'd be any expectation there.
  - batty_alex 6y ago
    I find it fascinating how okay you are with your employer tracking you. We aren’t to the life contract part of the dystopia yet, quit trying to skip ahead and give away your freedom so easily
    - Shank 6y ago
      Cloudflare sells security to people. If you don’t want to work at a company that has security requirements like that, don’t work there. Lots of people choose to donate their fingerprints, facial data, life history, and polygraphs to work for the government. That’s their choice to make.
      - tartoran 6y ago
        If that info is well taken care of is one think. If it ends up floating on the internet is another. Rfid badge data floating on the net creates is useless however other personal data could be very toxic in the wrong hands. And usually this info leaks thats why its not a great idea to let it outside the network let alone record it in the first place
Black101 6y ago
Pretty much all consumer security cameras do this by default nowadays... I had to disable it on mines and send it to my own server instead, as a backup.
spoonjim 6y ago
Putting the surveillance video on-site is... kinda dumb. If someone breaches your facility and wants to take the evidence of them doing so, they just have to steal the video storage. Cloud security footage makes sure that you have at least the footage up until they disable your network.
httpz 6y ago
When Microsoft Exchange servers were hacked a few days ago, people on hacker news were talking about how most companies are not capable of securing their own on-premise systems and they should have used Office 365. There really isn't a perfect solution. There are trade-offs.
- ocdtrekkie 6y ago
  It's a lot easier to secure on-premise Exchange than Office 365. For one, having OWA exposed to the Internet is entirely optional for Exchange on-prem... but impossible for avoid for a cloud service. Most possible ways to secure access to Exchange on-prem are built into your firewall, and you can configure at leisure... most possible ways to secure access to Office 365 are billable add-ons to your subscription. Any side channels to that... you just have to trust Microsoft... I agree there are trade-offs, but especially for large enterprises with security teams, on-prem is definitely more secure.
rapsey 6y ago
Unfortunately local storage is a problem. It is very vulnerable to arson or theft.
balfirevic 6y ago
> Shut this company down Who should shut it down?
Ensorceled 6y ago
There are actually plenty of reasons for remote storage of surveillance footage; not the least of which is that offsite storage of such video can be a regulatory or insurance requirement.
philjohn 6y ago
Another take on this - I have google nest outdoor cameras. Recently, a car park company tried to claim I was in a car park for 7 hours. In reality, I had gone earlier in the day, come back home, and then gone back hours later - but their ANPR system must have had a glitch. I was able to send them links to the video clips on the Nest site, with embedded timestamps. If this was a local system there would be no way to prove I hadn't just faked the timestamps.
- mattacular 6y ago
  You not having to pay an unfair fee for parking one time hardly seems like a good tradeoff for massive surveillance overreach by truly incompetent companies but maybe that was one really expensive lot or something
- listenallyall 6y ago
  >> no way to prove I hadn't just faked the timestamps. Showing a ticket? Parking lots have been using them pretty successfully for 50+ years
  - philjohn 6y ago
    Not in the UK - most free parking for shopping centres use ANPR cameras so that people who are going there for a few hours can do so, but people trying to be cheeky and park there all day to go elsewhere can't.
antihero 6y ago
Verkada has prioritized sales expansion over growing the engineering team, with 150% more salespeople than engineers and almost half the entire company in sales, per LinkedIn” Exactly the sort of people you want to trust with highly sensitive surveillance.
stjohnswarts 6y ago
Assuming one size fits all is dumb as well. This could be handled much better but it won't be cheap and that's what everyone is trying to do, "cheap". Other things are "on the web" and much less easily hacked.

_-david-_ 6y ago

I think the biggest selling point to cloud security cameras is to have a copy of the video not at the location. If your house / business is robbed or burns down you will possibly lose the video. This video could be used to find the theif or arsonist. Ideally it would store video locally, then encrypt it and upload the last minute to the cloud.

ocdtrekkie 6y ago
Plausibly, yes, though again, large enterprises should be able to handle this internally, especially some of the listed customers here.
- zerkten 6y ago
  There are plenty of use cases, such as the various forms of analysis with ML, which are often only implemented outside the "company firewall" (this idea is antiquated.) Of course, this could and should be handled inside a trusted boundary (I can't think of a better term for today's networks), but in practice security here is fairly immature and people try things when there isn't good governance in place.
  - TeMPOraL 6y ago
    This sounds like general problem of enterprise security. There are no consequences. I can entirely get why a company would outsource IP cameras to a third party cloud, even with storing data on-site. Business runs on contracts. It's entirely normal to contract out everything except your core competencies, if it's cheaper this way. It's how you turn CAPEX, complex OPEX and high risk into simple OPEX and low risk. A contract is in big part a risk shifting tool. This works well in practice... outside IT. The problem is, with IT and data, there's a mismatch between expectations and reality. An enterprise should feel safe buying their video surveillance from Verkada, because between the contract and the legal framework, Verkada should be bankrupt now, and their management possibly facing jail time. That's the part where contracts work as Cover-Your-Ass tool: if you shift risk and liability to outside party, the liability is not on you. However, this only works as long as the other party actually internalizes the risk and liability. Since there are no consequences for mishandling data, operating IT services you're not structurally competent to operate, and eventually having your crown jewels stolen - the contractor doesn't really internalize risk, has no incentive to mitigate it. All this to say: Verkada should go down after this, and their customers should be named and shamed widely - the latter is so that future customers of IT services put more care into vetting companies they contract IT out to. You shouldn't get to CYA with a contract where assumptions around contracting are broken.
- AmericanChopper 6y ago
  I work in a large enterprise. If my employer were to decide to exclusively store security footage on our own infrastructure, then I would have access to every piece of hardware it’s stored on. The risks associated with that is why every piece of mission critical data where I work is, at a minimum, backed up in a 3rd party facility.
nielsbot 6y ago
Also, convenience: Buy this camera, get access to recordings anywhere over the internet with nearly zero setup time. If you have an on-site system (like I do) it's way more effort for the average consumer.
- andrewprock 6y ago
  That's not security, that's voyeurism
  - vincnetas 6y ago
    Was also thinking the same. Security cameras should be used where there is an incident and additional information is needed to clarify what happened. Then you check the security camera footage to figure out what happened. If there were no incidents there is not reasonable need for anyone to look at that footage. edit: not talking here about active monitoring security cameras used by guards.
ma2rten 6y ago
Another one is that you can run machine learning on it. For example to automatically detect unusual activity.
- ocdtrekkie 6y ago
  You can absolutely run machine learning on-premise hardware.
brk 6y ago
The biggest selling point is really the OPEX sales model, and outsourcing of the general care-and-feeding of the recorders/servers. The tradeoff is that you tend to get lesser quality video and/or less scalability of the size of the system from bandwidth limitations. Theft of recorders/loss of recorded video is much much less of an issue than it is generally made out to be, and most systems have various means for auto backups, dual recording, etc. Many also have the ability to send select segments of video, based on motion or analytics, to cloud/FTP/email for free, which adds some extra resiliency if you are really worried about random arsonists :) (I work in the industry)
- pdimitar 6y ago
  > (I work in the industry) Ohhhh, you are so in trouble now! :P I am pondering moving to a rather remote estate with my wife but we're both city kids and have zero clue how to defend ourselves in such conditions (I am even thinking we should take shooting lessons and bring guns to the estate as well). Part of our plan is a surveillance system -- I planned to have an on-site ZFS storage cluster with several cameras that periodically encrypts the last 5 minutes and sends them off-site. Not sure how complex such a setup might turn out to be though... Maybe there's a way to make the storage cluster itself auto-replicate remotely often enough? I'm not that educated yet. Do you have any recommendations? I don't want to spend $5000 due to paranoia but I don't want to be defenseless in case of a robbery either. What's the middle ground?
  - brk 6y ago
    This isn't a short conversation, but you can contact me offline and I can give you some pointers.
    - pdimitar 6y ago
      Pinged you on twitter several hours ago, as I can't find any other accounts in your HN profile and don't want to stalk by looking you up online.
  - bigbillheck 6y ago

bsder 6y ago

> Putting surveillance video on the cloud is... kinda dumb. I tend to agree, but ... If you're a small business or manufacturer, IT is a pain in the ass. The "cloud" is a benefit because you don't need to maintain any servers yourself and can just get on with your business. The problem is that these companies don't face any consequence for claiming that they're secure and then not actually being ... you know ... secure. If this stuff was simply encrypted at rest, that would have mitigated most of this breach.

ocdtrekkie 6y ago
Sure, but many of Verkada's customers are large enterprises with large IT teams just making a bad decision. Small businesses have either a box they bought at Costco or use something like Comcast's service which they just add on to their cable modem.
- leesalminen 6y ago
  Those boxes from Costco come with WiFi built in and a mobile app paired to it. The small business owner invariably sets up port forwarding so they can watch from home and leaves the default password because it doesn’t force you to change it. Not much better there either.
  - ocdtrekkie 6y ago
    My point was less that those were good solutions, but that a company I contend "shouldn't exist" likely has a different customer segment, like Tesla and Cloudflare.
  - intrasight 6y ago
    Oh, the places I've boldly gone - using default passcodes
brundolf 6y ago
I don't think it would, because they leaked admin credentials (unless it was encrypted with a customer key and inaccessible to admin/support) Anyway, I think we're at the point with software/digital systems where food manufacturing was in 1900: there's been a gold-rush due to new technology, and we're reaching peak negligence in the pursuit of profit, and I think we'll soon get to a threshold where regulators will finally step in and lock down the wild-west and impose some real standards. Between SolarWinds, Exchange, and now this, it's to a point where it's dragging down our whole society. Something has to give.

Hnaomyiph 6y ago

It's amazing how much security people and companies are willing to give up for a smidge of convenience. Properly deployed CCTV has little worry of hackers since, hence it's name, it is closed-circuit.

lancesells 6y ago
This made me wonder if there's a place for a company to disrupt the video cloud industry by selling CCTV cameras and devices that would require physical updates sent on a usb drive.
- ocdtrekkie 6y ago
  It's not actually hard to do that today with existing equipment: Put it all on a network switch and then just... don't plug it into the Internet. Plenty of on-premise solutions exist and work with or without remote connectivity.
- vel0city 6y ago
  Get this: closed circuit television systems actually existed before updates could be delivered by the internet. Another crazy fact: there are still products sold which don't connect to the internet. You don't see nearly as many ads on these products though and don't seem to be as popular these days.
pugworthy 6y ago
Trust me, it's not always about convenience for some of us remote camera users. In my case, I've got a camera in my elderly parent's back yard as there have been a few falls in the back yard, and one break-in some years back.
- stjohnswarts 6y ago
  That seems like more trouble than it's worth though. Do you like just check every hour to see if someone has fallen or something? That seems like something that could become either an obsession or something you'd forget to do.

passivate 6y ago

Ouch! That's a bit harsh! Well, I suppose cloud archives could be encrypted? We use a cloud based system (but no cloud backup) and with multiple facilities, its nice to be able to launch the app and stream the camera's live feed using the cloud as a bounce. Also with the cloud being used as the de-facto off-site backup location, most data these days will end-up (hopefully encrypted) in some kind of cloud service or another.

ocdtrekkie 6y ago
Remote access is fine, it can be reasonably managed: Generally the client sets it, and the manufacturer doesn't retain access. Usually you can geoblock and such as well. You have control of the hardware and can implement encrypted storage and better access controls, rather than trusting a third party to decide what is "secure".

bredren 6y ago

This would be a much bigger hack if it were Wyze. Wyze cams are generally placed in residential interiors and contain a mic that can not be disconnected without physical removal. It wouldn’t be as newsy, though because people put these in their own homes. The only way this group raises awareness instead of angering people is by targeting companies and institutions, rather than forcing people to confront their own compromises with technology, time and effort.

tkinom 6y ago
Any known security issue with Wyze? I am very impress with their features. I am planning to buy couple of them, but I would never point them inside the house. Probably will put them in their own wifi network. I built a home grow solution with RPi + Webcam + Google Drive with some python script. But the performance to upload Pics to G Drive was slow and the way viewing the pics uploaded to G Drive was not very convenient.
- GloriousKoji 6y ago
  If you're serious about security I recommend against wyze. You're locked into their platform and it isn't fully reliable. If you want something like a video of that opossum sneaking in the attic, coyote peeing in your rose bushes, that kid across in the street with the razer scooter and german shepard not cleaning up the poop off your lawn or what your iguana is up to when you're not home then it's great for that. The UI is probably worse than your gdrive setup. You have to use the wyze app to access it, which has a terribly slow scrubbing interface. The more convenient part is to check the motion/sound triggered 15 second clips which are upload to their cloud servers. Other than that I find myself frustrated and just take out the microSD card and browse it on my computer. Also don't buy the sense kit. It just doesn't work. I've even tried experiments with it right next to the camera and it's not consistent enough. If you want to use the wyze cams are generic IP cameras they offer unsupported firmware for that but then you'll need to roll your own DVR and I'm not sure if that supports all the new features the V3 offers or follows the genric protocol for remote pan control.
  - 6y ago

tomc1985 6y ago

But then how will techbro wantrepreneurs build their unicorn business?!?!

Spooky23 6y ago

For anything small, the local drives are obvious theft targets. For anything large or distributed, you’re probably going to spend less for better security with a cloud system. It’s sensitive data, but probably in a second tier of sensitivity. The integrity of the on-prem system depends in your remote access security and operational practices. Solutions like this often really suck.

pugworthy 6y ago

> Putting surveillance video on the cloud is... kinda dumb It's a necessity for some cases. I commented on this elsewhere, but for me it's having an eye on my elderly parents back yard in case of falls. Past history of not knowing is precisely why we got the camera.

ronnier 6y ago
You can still keep them local and use a VPN. That's what I do.
- contravariant 6y ago
  People really should. It's pretty easy these days with wireguard or tailscale. Just plug a raspberry pi somewhere with network and power and you're set.
  - pugworthy 6y ago
    I spend my day doing the "tech shit" for work. I don't want to mess with stuff, I just want it to work. I'm willing to risk a bit of security for it to "just work", which it has now for multiple years. Without any security issues (so far).
    - contravariant 6y ago
      I completely agree, even though I do tinker around with stuff for fun. However in my experience so far wireguard and tailscale (which is based on wireguard) are the kind of solutions that just work with little to no oversight.
- SilverRed 6y ago
  Its still on the internet though. Its just the VPN becomes the security barrier. Although if you keep it up to date, its going to be safer than iot crap

mike_d 6y ago

> It's rarely viewed outside your network The majority of real camera systems (100+ cameras, 10+ locations) I have interacted with are monitored by outside vendors.

quasirandom 6y ago

There's more information here as well. Cloudflare was apparently operating network connected facial recognition cameras in their offices. I'm not someone who's crazy about privacy, but this is a pretty dark indicator for a company housing DNS query records. Maybe its time for someone to build a proxy for tunneling Cloudflare DoH/DoT over tor or some other free mixing network.

bradlys 6y ago
How is that something to be worried about? There are companies out there that try to monitor if employees are in rooms/areas that they're not supposed to be. You can do that with badges/RFID but then people can take a card or slide by in various ways. (Happens all the time at big companies - people just tailgate) If anything, they might be taking privacy more seriously by not letting people without authorized access into secure areas. I think you give up any sense of privacy as to where you're located in an office or where you've been in an office when you decide to work in an office owned by some employer. I don't know why there'd be any expectation there.
- batty_alex 6y ago
  I find it fascinating how okay you are with your employer tracking you. We aren’t to the life contract part of the dystopia yet, quit trying to skip ahead and give away your freedom so easily
  - Shank 6y ago
    Cloudflare sells security to people. If you don’t want to work at a company that has security requirements like that, don’t work there. Lots of people choose to donate their fingerprints, facial data, life history, and polygraphs to work for the government. That’s their choice to make.
    - tartoran 6y ago
      If that info is well taken care of is one think. If it ends up floating on the internet is another. Rfid badge data floating on the net creates is useless however other personal data could be very toxic in the wrong hands. And usually this info leaks thats why its not a great idea to let it outside the network let alone record it in the first place

Black101 6y ago

Pretty much all consumer security cameras do this by default nowadays... I had to disable it on mines and send it to my own server instead, as a backup.

spoonjim 6y ago

Putting the surveillance video on-site is... kinda dumb. If someone breaches your facility and wants to take the evidence of them doing so, they just have to steal the video storage. Cloud security footage makes sure that you have at least the footage up until they disable your network.

httpz 6y ago

When Microsoft Exchange servers were hacked a few days ago, people on hacker news were talking about how most companies are not capable of securing their own on-premise systems and they should have used Office 365. There really isn't a perfect solution. There are trade-offs.

ocdtrekkie 6y ago
It's a lot easier to secure on-premise Exchange than Office 365. For one, having OWA exposed to the Internet is entirely optional for Exchange on-prem... but impossible for avoid for a cloud service. Most possible ways to secure access to Exchange on-prem are built into your firewall, and you can configure at leisure... most possible ways to secure access to Office 365 are billable add-ons to your subscription. Any side channels to that... you just have to trust Microsoft... I agree there are trade-offs, but especially for large enterprises with security teams, on-prem is definitely more secure.

rapsey 6y ago

Unfortunately local storage is a problem. It is very vulnerable to arson or theft.

balfirevic 6y ago

> Shut this company down Who should shut it down?

Ensorceled 6y ago

There are actually plenty of reasons for remote storage of surveillance footage; not the least of which is that offsite storage of such video can be a regulatory or insurance requirement.

philjohn 6y ago

Another take on this - I have google nest outdoor cameras. Recently, a car park company tried to claim I was in a car park for 7 hours. In reality, I had gone earlier in the day, come back home, and then gone back hours later - but their ANPR system must have had a glitch. I was able to send them links to the video clips on the Nest site, with embedded timestamps. If this was a local system there would be no way to prove I hadn't just faked the timestamps.

mattacular 6y ago
You not having to pay an unfair fee for parking one time hardly seems like a good tradeoff for massive surveillance overreach by truly incompetent companies but maybe that was one really expensive lot or something
listenallyall 6y ago
>> no way to prove I hadn't just faked the timestamps. Showing a ticket? Parking lots have been using them pretty successfully for 50+ years
- philjohn 6y ago
  Not in the UK - most free parking for shopping centres use ANPR cameras so that people who are going there for a few hours can do so, but people trying to be cheeky and park there all day to go elsewhere can't.

antihero 6y ago

Verkada has prioritized sales expansion over growing the engineering team, with 150% more salespeople than engineers and almost half the entire company in sales, per LinkedIn” Exactly the sort of people you want to trust with highly sensitive surveillance.

stjohnswarts 6y ago

Assuming one size fits all is dumb as well. This could be handled much better but it won't be cheap and that's what everyone is trying to do, "cheap". Other things are "on the web" and much less easily hacked.