Teardown shows Nest Cam is always on even when you think it’s off | Hacker News Reader

Teardown shows Nest Cam is always on even when you think it’s off

arstechnica.com

64 pointsswatthatfly31 comments

Take it as you will, but some of the comments in the article are saying that the only things left active are the wifi functionality to remotely switch the device on again, and that the 'camera' part is completely disabled as you'd expect.

So at the moment, it's a bit less ominous than the title suggests.

That said, I do find it irritating how many devices seem to want to be on permanent 'standby' nowadays, especially given all the talk about wasting electricity. Or the related worries about spies being able to remotely activate devices because they're not completely off.

It says it stops transmitting the video to the cloud service. It doesn't say it turns of the camera part. In fact, from the power draw and the ABI article it seems the only things being turned of are the camera indicator led and the motion detection. Recording seems to continue at 1080p.

> Recording seems to continue

It has no on-board storage. Where exactly do you think it's recording to, if it's not transmitting?

It doesn't have to store the video to process it?

No. Dropcam streams. There's no on-board storage. (Ok, maybe there's a megabyte or so - enough to store about one second of video for buffering before transmitting.)

How does that negate my statement? You don't have to store (much of) the video to process it locally on the device. As an example, it's being compressed before streaming. As to whether it does something with the video is another question, but it's definitely possible without storage.

... which is exactly what I said. You asked "It doesn't have to store the video to process it?", and I said no, it doesn't, other than a small amount for processing.

Ah, sorry, I misinterpreted your answer. My question was meant to be rather rhetorical. I forget it doesn't always work in written form.

this could be technically true, if you shutdown the streaming totally, resuming it cleanly normally require a reboot, which is slow for customers, which is why the reason the encoding is kept running all the time. Been there done that.

I don't like paying money for devices and services that are able to steal my data and/or spy on me.

I would like a security camera that is not able to connect to the outside world (when I'm back, it would allow me to see what was happening when I was out). I guess it should be allowed to the local network.

Does anyone have a recommendation for a good one?

Any normal surveillance system. E.g. an Axis IP camera with ZoneMinder (not that great but FOSS) or one of several commercial network video recorder (NVR) options running on a machine somewhere. Ubiquiti even makes IP cameras and an NVR appliance now. Any decent NVR will also support remote video streaming, you might need to configure your network appliances appropriately.

Don't do analog. It's cheaper but it's not really worth it, you should get at least 720p these days (that means IP) and I'd reckon analog equipment won't be easy to buy for very many more years.

Don't do wifi. You need to get power to the camera anyway, so run ethernet with PoE. All these WiFi surveillance cameras are crazy, jammers are pretty easy to obtain and burglars are going to start using them. In a business installation, you should segment the cameras from the rest of the network, with VLANs or separate switches. Dual-home your NVR or lock it down at a firewall. It's just good practice.

The current trend of cloud-based surveillance is something I find very strange. It's more convenient in some ways than a local DVR or NVR but that comes at a big cost, including often monthly service fees! I think it's really only because of a lack of sufficiently consumer-friendly NVRs. There might be some money there for someone who takes that on.

I think there is an ever increasing market for reverse engineered services for products like this. I would love to have a local instance of their back end running, that I would be in total control of.

That way I could choose to make it work externally or not, or even have it working when there is not external internet connectivity.

The problem is, the perceived value of these companies is having access to the video. I'm sure it won't be long before they start auto analysis the video for "faces" or "products" or what TV/Music you listened as a "feature". At which point we slowly start to boil...

there are cameras with a lid that you can physically close video-taking, no way to bypass it.

>I would like a security camera that is not able to connect to the outside world

The whole point is to have offsite backup. Very first thing more sophisticated thugs do is disable and steal your DVR setup:

http://www.theatlantic.com/politics/archive/2015/08/the-chut...

Surveillance cameras constitute an "illegal eavesdropping operation", says Santa Ana Police Association. Sick. More and more you have to consider LE as the enemy when worrying about security (both physical and digital).

Sure, but the product and the service should be separate, so that you are free to choose your storage provider, and so that you can be sure the service can't do anything nasty with your product. Allowing products and services to be converged is bad for consumers.

I recently built one with my raspberry pi and the camera module. It was stupidly easy, all the difficult parts (motion detection, saving short video recordings) are all done for you.

I upload everything to s3, and set notifications on the bucket to my phone. If motion is detected, I get an email within a few seconds.

If you're serious about not being spied on, the only reasonable thing to do is to build it yourself. Luckily, these days, that's very easy and cheap.

How can you be sure you cannot be spied on, if you upload to the cloud?

If I was that paranoid, I'd encrypt the files. However I trust Amazon not to look at the contents of S3 buckets (being caught doing so would severely damage their business).

  being caught doing so would severely damage
  their business

The threat of bad publicity for his employer discourages Andy from looking in the S3 buckets. But it also stops Bob blowing the whistle if he sees Andy looking in the S3 buckets.

If you're paranoid, you can always encrypt before uploading.

Any chance you could point at the libraries you are using?

There is a Linux program called Motion that I use to monitor my IP cameras.

It records to a location of your choosing and has pre and post motion detection hooks allowing you to email the pictures or videos to yourself when motion is detected.

IME it works quite well. I setup one camera and motion uses about 60% CPU, but there was no noticeable increase when I added camera 2 3 and 4.

There's a program called `motion` that I've used in the past for a similar setup.

http://linux.die.net/man/1/motion

Simple. Get any IP camera and configure firewall on your router accordingly to disable its access to anything else than local network.

A general purpose computer seems like the worst possible thing you could buy then.

You can't really know what it does because the firmware is closed. Firmware on devices like this is an example of why open source is so important.

Dropcam has been rooted before, no idea if nest changed anything

How do I know the article is sensationalist shit? "vice president of teardowns at ABI Research"

I am Senior Vice President of making spiteful comments at my house.

"If a tree falls in a forest and no one is around to hear it, does it make a sound?"

If it wasn't heard then it didn't fall.

Reply on news.ycombinator.com