Hacker News Reader

Fwiw, most of the cameras are behind NATs, the ones on the sites have public IPs. A NAT effectively firewalls your camera from the internet, but yes once on LAN they’re unauthenticated.

View on HN

The way these IP cameras work is that when you configure them from an app or some dodgy viewer is that that software calls the cloud server, and tells it what the details are for your LAN connected IP cameras.

You really can't let them know how to dial out. Most of them have hardcoded passwords and/or known exploits.

It's why they're so cheap on the 'zon.

NAT wont stop an unsecured IP camera from happily streaming content out of your network. Always deploy (and properly configure) an actual firewall to control ingress and egress of packets on your network.

Or secure your network with just NAT if you want. I really don't care.

Yeah, NAT is fairly secure in the sense that it blocks incoming connections... you're kind of a security nut if you lock down all ports. Anyone outgoing will just stream over 80 or 443 anyways, port based firewalls are pretty antiquated. You can't really lock down port 80 and still have a functional network unless you whitelist every device you connect.

But you can lock down that egress for your cameras. Why does your camera need to establish any outbound stream at all? Might want to keep an eye on that...

Reply on news.ycombinator.com