From your doorbell to your home network | Hacker News Reader

From your doorbell to your home network

adepts.of0x.cc

92 pointsmmoogle13 comments

This is just one reason I prefer zigbee for smarthome devices. There is a protocol-level isolation between them and my home network. Really sad to see zigbee devices getting rarer

I just started zigbeeing and making my own zigbee devices, I wouldn't say they are rare.

There some glaring holes in products (wall-pluggable lights, eink displays, scales, pressure gauges, etc.) but buying an esp32-c6 and you can fill the gaps

> I wouldn't say they are rare.

Better known brands are starting to drop zigbee for matter (Ikea has moved, the last aqara zigbee device I bought required me to get an aqara matter hub and flash the firmware through their app to switch it to zigbee from matter).

It's feeling like for more devices I'm stuck with unknown aliexpress products (I know behind the scenes they're mostly the same devices but I'm generally okay paying a bit more to get a known company with some known QA level for these types of things).

I bought some of the new Ikea smart lightbulbs that use Matter-over-Thread instead of zigbee. When I tried to use them with my home assistant setup, I discovered that the pairing process involved using a smartphone to take a picture of a QR code and then doing some kind of complex syncing process that ended up failing because I use GrapheneOS on my phone and the syncing process required Google services. I ended up returning them and buying Zigbee smart lightbulbs instead from a competitor.

What brand did you end up buying? I have some 5 year old ZigBee bulbs that are starting to fail and need a replacement.

I forget the exact brand, whatever was cheapest on Amazon at the time.

This is why my doorbell is on a separate VLAN, without internet access.

Yeah but you lose some capabilities of the product.

It's hard to get the convenience of remote access and network isolation.

Network isolation, unless it's true airgapping (and then lack of remote access is a feature), relies on router not forwarding traffic where it shouldn't go.

Same goes for NVR or intermediate hub(s) (if NVR is somewhere outside of one's premises). They should only accept what they need and know how to handle, and reject anything else.

Those Eufy homebases are just poorly designed, that's all.

This was honestly more secure than I expected. Nothing that would survive defcon but that’s a neat sync protocol.

Does anyone ever wonder why a doorbell needs to be connected? I do, so I don't have one. Diminishing returns by design? I've never been like "oh I am glad my doorbell is connected to my network". Wondering what marketing I didn't see (and fall for).

A normal, physical doorbell is 24/7 connected to electricity, else it wouldn't work. It typically has no surveillance capabilities, except when used, it makes a sound/signal/buzz. That's typically its purpose.

A 'smart' doorbell [meta: I hate this terminology, and will just call it 'doorbell camera' for the rest of this post] needs electricity in order to do the very same, but it also serves another purpose: record (via camera and microphone, and sometimes other sensors ie. IR camera). This recording of data can be stored, analyzed, etc. For example, you can perform ML on the feed to detect dogs, you can do data analysis on it for example when postal service usually arrives, you can record postal service stows packages away in the premises, etc. In order for it to be analyzed, it needs networking capabilities (wired, or wireless). Doorbells need to be serviceable, so they can typically be dismantled from the outside. Wired and wireless can both be MITM'ed, and DoS'ed. If that happens, you want the feed to be recorded as much as possible, in order to record the attacker. You also want to secure your feed. In order to MITM or DoS a wired doorbell, physical access is required which is why a wired doorbell is superior IMO.

There's no need for your camera to have internet access. Some ports have to be accessible from your NVR; that's it: you need to be able to update the firmware (e.g. to protect against vulnerabilities such as KRACK), and you need to be able to record your stream (e.g. access the RTSP stream). A speaker or screen can be useful to communicate with a visitor. Your NVR can manage all of this, and so can you (usually via a reverse proxy with internet access, but we shouldn't neglect authentication here). The doorbell camera itself doesn't need such. It does, however, need some form of networking capabilities.

So what I do: apart from having it in a separate VLAN, I record my feed, and immediately store it locally (on-prem) and remotely (via adequate internet access; in my case, not in cloud). However, my doorbell camera is connected via Wi-Fi. This is where the story e

There's also different levels of smart doorbells. Our doorbell is smart, when it rings, it sends a notification to our phones, but we don't have a camera hooked up to it.

Reply on news.ycombinator.com