Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open-source private home security camera system (end-to-end encryption)

github.com

Post reply on HN
Print view View original

21–30 of 180 posts

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#21

Post by arrdalan »

EthicalSimilar wrote: post #3

Did you look into Scrypted? It is OSS. With HomeKit (which is how I use it) it is also E2EE. I’m not sure if their app is E2EE though, I only use HomeKit. It’s pretty good and has an extensive ecosystem. The dev can be a bit… feisty though. It’s very performant and easy to setup. I don’t use the NVR features as I already have an NVR, I essentially just use it for HomeKit integration of my cameras + doorbell. https://…

I'm not familiar with Scrypted unfortunately. But thanks for the pointer. I'll have to study it to understand its security and privacy implications. I skimmed the docs very quickly but couldn't find info on their use of encryption.

About HomeKit: yes, HomeKit uses iCloud end-to-end encryption (https://support.apple.com/en-us/102651) and is certainly superior to those systems that don't use encryption at all or just use encryption between the device and their servers. But Privastead has two advantages:

1) Privastead uses MLS for end-to-end encryption, which provides forward secrecy and post-compromise security. iCloud's end-to-end encryption does not. So what does that mean? This is from the link I included earlier:

"If you lose access to your account, only you can recover this data, using your device passcode or password, recovery contact, or recovery key."

If an attacker manages to access your password, recovery key, etc., they'll be able to decrypt all your videos (assuming they have recorded all your encrypted videos). Such an attack is not possible in MLS. Similar to the Signal protocol, MLS uses double ratchet and there is not a single password, recovery code, key, etc. that can decrypt everything.

2) The HomeKit framework and iCloud end-to-end encryption are not fully open source as far as I know. Therefore, we simply have to trust what Apple says about their security and privacy implications. That might be okay for some users, but not others. Privastead is and intends to remain fully open source. IMO, being open source is a critical component of any security/privacy solution that would like to gain users' trust.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#22

Post by arrdalan »

amluto wrote: post #20

Nifty. Have you considered trying to make the server be able to run as something like a Cloudflare worker?

Not yet. The server is currently fairly simple and doesn't do much other than relaying ciphertexts (and MLS group welcome messages). It should be okay serving one user and several cameras, but is certainly not scalable. I have plans to improve its scalability, but that is not at the top of the todo list. I'll check out Cloudflare workers for sure. Thanks.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#23

Post by hughesjj »

stevenpetryk wrote: post #18
VTimofeenko wrote: post #12

I've been a happy user of frigate ( https://frigate.video ) with fully local isolated setup: multiple poe cameras on a dedicated network, coral to supplement on-camera recognition, HA+Prometheus for alerts and smarts. Excited to see another project, especially in Rust(not for the memes; python env management has bit me a few times when hacking). One major gripe with frigate that I have is the way it treats detection…

Have you found cameras you’re happy with? That’s the main thing holding me back is not knowing a good PoE camera to use.

Hikvision and reolink are highly rated onvif ones that support poe, but as long as the camera support ONVIF from there just compare as normal

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#25

Post by arrdalan »

nzeid wrote: post #5

I'm deeply interested in this and it just so happens I only need one hardened IP camera for my home. Can you point out how your project provides a better security layout than say, Home Assistant? It does appear that there is little concern for encryption between cameras and local networking hubs, but the assumption seems to be that if the device is over a wire it's isolated to the local network, and if it's Wi-Fi it'…

If you use Home Assistant in an isolated local network with no Internet access, you will have good privacy. However, I needed to be able to use my camera remotely from my phone. That's when using strong end-to-end encryption becomes critical.

Home Assistant seems to provide two options for remote access: https://www.home-assistant.io/docs/configuration/securing/

One option is to expose your instance to the Internet and using TLS/SSL to connect to it remotely. To me, that's risky since any machine exposed to the Internet is going to see more attack attempts and is harder to secure. The second option is to use their cloud. Here, they explain how remote access through their cloud works: https://www.nabucasa.com/config/remote/#security

They also mention its weaknesses:

"Before we talk about weaknesses, know that we will never abuse any weakness unless forced by a government entity. Our approach has one single weakness that is unavoidable: since we own the domain that hosts the remote connection, we are able to issue our own certificate and man-in-the-middle attack (MITM) remote connections. This would allow us to see all data passing through, including authentication tokens."

Privastead's use of MLS provides strong end-to-end encryption. And Privastead is not vulnerable to MITM attacks due to its secure pairing solution. I plan to write more about the security of Privastead including its pairing solution.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#26

Post by VTimofeenko »

stevenpetryk wrote: post #18
VTimofeenko wrote: post #12

I've been a happy user of frigate ( https://frigate.video ) with fully local isolated setup: multiple poe cameras on a dedicated network, coral to supplement on-camera recognition, HA+Prometheus for alerts and smarts. Excited to see another project, especially in Rust(not for the memes; python env management has bit me a few times when hacking). One major gripe with frigate that I have is the way it treats detection…

Have you found cameras you’re happy with? That’s the main thing holding me back is not knowing a good PoE camera to use.

Reolink have not disappointed me so far. I am using a duo 2 cam watching over the front of the property and a collection of their bullet cams. There's a lot of recommendations on frigate github discussions. Some models indeed have quirks.

On top of decent cameras they also have pretty well-documented API.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#27

Post by hathawsh »

arrdalan wrote: post #25
nzeid wrote: post #5

I'm deeply interested in this and it just so happens I only need one hardened IP camera for my home. Can you point out how your project provides a better security layout than say, Home Assistant? It does appear that there is little concern for encryption between cameras and local networking hubs, but the assumption seems to be that if the device is over a wire it's isolated to the local network, and if it's Wi-Fi it'…

If you use Home Assistant in an isolated local network with no Internet access, you will have good privacy. However, I needed to be able to use my camera remotely from my phone. That's when using strong end-to-end encryption becomes critical. Home Assistant seems to provide two options for remote access: https://www.home-assistant.io/docs/configuration/securing/ One option is to expose your instance to the Internet a…

A third option is to set up a Wireguard service and expose the web UI only through the VPN. I use the Wireguard app to connect my phone to my VPN. This solution seems very safe to me. Are there risks I'm not thinking of?

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#28

Post by arrdalan »

VTimofeenko wrote: post #12

I've been a happy user of frigate ( https://frigate.video ) with fully local isolated setup: multiple poe cameras on a dedicated network, coral to supplement on-camera recognition, HA+Prometheus for alerts and smarts. Excited to see another project, especially in Rust(not for the memes; python env management has bit me a few times when hacking). One major gripe with frigate that I have is the way it treats detection…

A fully isolated setup on a dedicated network can certainly provide good privacy. A key benefit of Privastead is that it can send the videos to your smartphone remotely using a strong (MLS-based) end-to-end encryption.

And I share your excitement about Rust. :-)

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#29

Post by arrdalan »

StayTrue wrote: post #15

My DIY setup uses cameras on an isolated VLAN that prohibits outbound internet access, RTSP data collected by Frigate[0] with Coral TPU recognition, and alerts via Pushover[1] notifications. My push notifications include an unencrypted thumbnail with a link to Frigate that only works via VPN connection. Seems like this project offers a lot of what I had to cobble together. Nice work. I like that it offers encrypted n…

A fully isolated setup can certainly provide good privacy. A key benefit of Privastead is that it can send the videos to your smartphone remotely using a strong (MLS-based) end-to-end encryption.

Privastead does not currently send thumbnails as part of the notifications. Performing proper end-to-end encryption on data in push notifications is a bit tricky and I haven't solved that yet. I do have some ideas on how to make that happen though. Once I do, I plan to add thumbnails to push notifications as well.

And thanks for the pointer on Pushover. I'll check it out to see if it can be a replacement for Google FCM.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#30

Post by arrdalan »

hackermeows wrote: post #24

Do self hosted options qualify for insurance discounts ?

Good question. I'm not really familiar with insurance requirements. Privastead simply records videos from an IP camera and sends it to your phone. It does not modify the videos and hopefully that should be adequate for insurance companies.
Post reply on HN