Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open-source private home security camera system (end-to-end encryption)

github.com

Post reply on HN
Print view View original

171–180 of 180 posts

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#171

Post by scottlamb »

arrdalan wrote: post #167
scottlamb wrote: post #159

Earlier quoted context omitted.

The question of "What is the purpose of introducing the untrusted "server" component?". Looks like you've since replied to this, but it wasn't here or I didn't see it when I dropped the parent comment. The reply also doesn't compare alternatives such as direct use of an object store API. I've fielded a lot of user support questions about installation and would really hesitate to add that extra moving part if it's not…

Yes, we have different approaches/designs. In fact, I don't even of think of Privastead as an NVR solution. The choice of using a hub is mainly because I didn't have control of the camera firmware. As I've mentioned in other comments, if I could, I'd move the hub logic to directly run inside the camera. And my main comparison has been with security camera solutions that use their cloud solution to transfer videos (e.…

> The choice of using a hub is mainly because I didn't have control of the camera firmware. As I've mentioned in other comments, if I could, I'd move the hub logic to directly run inside the camera.

Yeah. I'm also frustrated with cameras in general. I've commented on this a few times here before, [1] but tl;dr: I don't even know what camera I'd recommend even if I had the perfect open source firmware to flash onto it easily.

> Regarding the multi-user support: yes, that's on the to-do list. A nice aspect of MLS is the notion of groups that it provides. In Privastead, each camera will have a separate MLS group and it could add multiple devices/smartphones to the group. The hub will then try to deliver the video to all devices in the group. Many aspects of the multi-user support still needs to be figured out, but it's technically feasible.

Okay, interesting, yeah that sounds like a significant step up for most folks.

> Regarding ffmpeg: I agree. I'm aware of it and I have it in my to-do list to replace that with a Rust-based implementation. In fact, I'll be looking into your retina library as one potential replacement. :-)

Patches very welcome. It could use more attention than I've been able to give it recently but likely will interact well with your camera model as-is.

[1] https://news.ycombinator.com/item?id=37815064

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#172

Post by e40 »

ranger_danger wrote: post #4
KetoManx64 wrote: post #2

Wow!! Very cool project. The reasons you mentioned above are the exact reason that I have not setup security cameras at my house, but this makes me reconsider. Combined with the OSS firmware: https://github.com/openmiko/openmiko this would make a killer combo for privacy conscious individuals.

The best time to have security cameras is yesterday. Same for a dash cam. Please protect yourself and your loved ones.

Any dashcam recommendations? Last time I looked (last year) there were issues with all the top models I saw recommendations for.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#173

Post by KetoManx64 »

INTPenis wrote: post #103
goodpoint wrote: post #52

Earlier quoted context omitted.

What's a realistic use-case for secure boot on a camera? It's such a corner case...

A friend discovered it when he was wanting to monitor his datacenter and considering local security. A situation where someone has access to your DC and could theoretically erase images of them being there since they also have local access to your cameras.

So someone is going to access your camera, power it off, flash a custom firmware to it that they have themselves written that gives them backdoor access to the camera, somehow set it up so that it also has network access that you cannot see on your firewall or network monitoring tools? Then they login to your servers and hope that you don't have any logs enabled that automatically get sent off to a cloud server somewhere. Sounds like your friend has some three letter agency enemies.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#175

Post by sneak »

tills13 wrote: post #158
sneak wrote: post #128

Earlier quoted context omitted.

It is reasonable to assume that Ubiquiti has remote access to your fully local data, given that they run the auth server and also push automatically installed updates.

> they run the auth server I don't think this is true unless you are logging into your router using the ui.com console. Logging in to my UDM POSTs to the local address and works without a WAN connection. > also push automatically installed updates I suppose if you've enabled them.

Autoupdate is on by default.

Even for local auth, the auth database comes from the cloud service.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#176

Post by tills13 »

sneak wrote: post #175
tills13 wrote: post #158

Earlier quoted context omitted.

> they run the auth server I don't think this is true unless you are logging into your router using the ui.com console. Logging in to my UDM POSTs to the local address and works without a WAN connection. > also push automatically installed updates I suppose if you've enabled them.

Autoupdate is on by default. Even for local auth, the auth database comes from the cloud service.

Either way I wouldn't say it's "reasonable" that anyone at Ubiquiti has access to your NVR. A very skeptical and doomer take imo.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#177

Post by chfritz »

WebRTC is end-to-end encrypted, too, and unlike OpenMLS is designed for video streaming, so it's great for low-latency live viewing, even over terrible network connections. We are using it in robotic and built a component you can just embed in any web page/app (not open-source, sorry): https://transitiverobotics.com/caps/transitive-robotics/webr... On the device side it supports hardware acceleration on Nvidia, RockChip, and Intel devices with VA-API support (e.g., NUKs).

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#178

Post by INTPenis »

KetoManx64 wrote: post #173
INTPenis wrote: post #103

Earlier quoted context omitted.

A friend discovered it when he was wanting to monitor his datacenter and considering local security. A situation where someone has access to your DC and could theoretically erase images of them being there since they also have local access to your cameras.

So someone is going to access your camera, power it off, flash a custom firmware to it that they have themselves written that gives them backdoor access to the camera, somehow set it up so that it also has network access that you cannot see on your firewall or network monitoring tools? Then they login to your servers and hope that you don't have any logs enabled that automatically get sent off to a cloud server somew…

Maybe it's not about your enemies but rather wanting to provide a certain level of security to your clients.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#179

Post by hughesjj »

hipitihop wrote: post #35
hughesjj wrote: post #23

Earlier quoted context omitted.

Hikvision and reolink are highly rated onvif ones that support poe, but as long as the camera support ONVIF from there just compare as normal

I can second Frigate and welcome any work in this space, so nice work OP will have a look. For others asking, I have found so far Hikvision POE PTZ domes like DS-2DE2A404IW-DE3 have been reliable, depends on your budget. I have cams themselves fully locked down from internet and on a separate subnet on the local net. OPNSense is also a friend here. I would love some OSS firmware for these cams. For remote, I find Zer…

Oh wire guard is a requirement imo, regardless of NVR or camera vendor. I'm less worried about a nation on the other side of the Pacific getting a livestream of my property than I am someone social engineering some rando employee at Ring/whereever and figuring out the best time to rob me or whatever.

Also set up alerts on shodan opencve etc. If you have anything but a phone and personal computer on your home network, assume they're hacked and treat it like you would coffee shop wifi during defcon.

Because... Well they are. Zero days are a thing, and by definition by the time you learn of one it's too late.

Honestly I'm more concerned about the compromised device being an attack vector for network sniffing etc moreso than the video itself... Which is yet another reason why I try to 100% VPN even at home, but man okta doesn't play well with VPNs.

Re: Show HN: Open-source private home security camera system (end-to-end encryption)

#180

Post by paledot »

ndsipa_pomu wrote: post #164
Klonoar wrote: post #149

Earlier quoted context omitted.

A number of dash cams now use cloud storage. If anything, when I last purchased I had to go out of my way to find one with decent enough video that also stays local.

That's surprising - I would guess that cloud storage would add to the price of them as they'd need a mobile data connection and presumably monthly costs. They must be designed for fleet management where you don't necessarily trust the driver to not delete footage.

Your personal information is valuable. See also why smart TVs are/were cheaper than "dumb" TVs when the latter was even still an option.
Post reply on HN