Hacker News Reader

Comment by ceejayoz | Hacker News Reader

They do it so they can view the camera remotely, like when they're on vacation.

Take a look at Axis Secure Remote Access solution for a way to avoid port forwarding (with its issues) and still get remote access, basically no configuration at all except from actually initially adding the camera to your site.

Only works on Axis cameras though with Axis client software I should mention.

Take a look at Blue Iris (unfortunately Windows only). It supports almost every camera imaginable, and has the benefit that it runs on a single Windows server you can secure, while it pulls camera feeds directly from the cameras over your private network. You can still download a mobile app and connect securely to the video server to browse recordings or watch live feeds.

I much prefer this model, because then I don't have to trust all these terrible cameras; simply isolate them on a private wifi network that only your Blue Iris server can reach.

That's essentially using their servers as a middle-man. Which raises the question: why would one trust Axis to build servers that withstand attacks but not to build cameras that do the same?

It's still end-to-end encrypted though. Going through their servers it is in case peer-to-peer isn't possible to setup, otherwise it's a direct encrypted link between you and your camera (with client+server certificate validation) without any mediator servers.

Regarding servers vs cameras: To oversimplify; servers can have exponentially more capacity. Either how, in this case, the traffic is encrypted in each end so there's nothing to be done by "the middle man servers", they can't decrypt anything cause they don't possess the keys.

Also to have an external backup of the video feed.

Otherwise, if you get robbed, and they happen to steal your NAS, you've lost the main reason to have a security camera in the first place - to identify the perp.

I purchased a TP-LINK camera and didn't want to use their cloud, so I made it ftp images to a Raspberry Pi and then forward them to me via a Telegram Bot. I've been pondering getting OpenWRT on the camera and then running the bot directly on it; I'm not sure it's feasible.

This, and with the camera it looks like it automatically opened up firewall ports by itself using UPNP

People need to VPN home to see their fucking cameras lol.

People don't care. They don't think anybody else is going to be interested in watching their cameras, and it doesn't even cross their mind that a camera could be vulnerable to an exploit. They don't even know what an exploit is. Once they can see their camera from their phone, they don't care what else is happening.

Reply on news.ycombinator.com