News for hackers. Stuff that matters.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Thursday October 24, 2019 @01:43PM (#21347118)
> I boggle at why security cameras would be sending the video offsite to a third party.

Ring isn't a "third party", they're the party from which users (of which I am one) buy the cameras and the services that go with them.

One of the services is being able to see live views from your cameras, or watch stored videos, from anywhere through the app. This is very useful if you're away from home. Storing videos locally wouldn't support that.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by eropple on Thursday October 24, 2019 @01:49PM (#21347204)
> Storing videos locally wouldn't support that.

Of course it is--don't fall for the okeydoke. Encrypt with a passphrase. Provide the same passphrase in the app. Ring's central server exists only to pull streams on-demand and route them directly to the app. Ring can still even store VOD data if you really want; they don't have the ability to perpetuate the panopticon through it, though.

There, I fixed it.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Thursday October 24, 2019 @08:24PM (#21350550)
> Encrypt with a passphrase. Provide the same passphrase in the app.

Are you saying Ring already offers this capability?

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by eropple on Thursday October 24, 2019 @09:35PM (#21350974)
Sorry, I mean that Ring's server then only acts as a router. I strongly doubt it does that now, though I wouldn't give them money so I can't say for sure.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by MereInterest on Thursday October 24, 2019 @01:49PM (#21347203)
Yes, storing video locally would support that. On request, the app and the local storage would negotiate a session key, and the video would be transferred to the phone. Ring would only have the encrypted video, and would not have the decryption key for it.

Yes, it would be slower, would require video encoding/rescaling near the local storage, but it would actually be secure that way.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Thursday October 24, 2019 @02:28PM (#21347633)
> storing video locally would support that. On request, the app and the local storage would negotiate a session key, and the video would be transferred to the phone.

How do they do that if the app is halfway across the country? They have to go through a common server.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by paggle on Thursday October 24, 2019 @02:31PM (#21347688)
With public key encryption.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Thursday October 24, 2019 @08:23PM (#21350540)
Public-key encryption requires the two endpoints to be able to send each other data. See my comments about ISPs and firewalls elsewhere in this thread.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by paggle on Friday October 25, 2019 @01:50AM (#21352241)
Yes, nobody is saying there won't be a central server... just that said central server won't be able to access the contents of the video.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by Sohcahtoa82 on Thursday October 24, 2019 @08:19PM (#21350517)
The same way an HTTP[S] proxy works.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Thursday October 24, 2019 @08:24PM (#21350546)
How would an HTTP[S] proxy help me to talk to a computer that's behind my home NAT firewall if my ISP won't allow me to run Internet-visible servers?
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by Sohcahtoa82 on Friday October 25, 2019 @10:35AM (#21355346)
First off, as mentioned in other comments, ISPs tend to not enforce the rules about not running Internet-visible servers.

But let's go ahead and go with your assumption that they are. You can still have a secure connection from your doorbell camera to a mobile app anywhere in the world. Both your app and your camera connect to an intermediate server. This server merely acts like a proxy, passing packets between the two. Using a standard TLS handshake, the app can establish encryption with the camera without the proxy in the middle being able to decrypt the traffic. When the camera is initially setup, it can generate a TLS certificate that the app can download and pin (Since the app and camera will be on the same Wifi network), so that the proxy server can't try to present its own and intercept the communications.

If you need me to go into greater detail, I can. But this is definitely a solved problem.

EDIT: Another way to think of this...apps like Signal and Wire let people talk to each other by each client connecting to a central server to send and retrieve messages, but without the ability for those central servers to intercept the contents of the messages through public key encryption. The camera-to-app connection would work basically the same way.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Sunday October 27, 2019 @01:30AM (#21368029)
I understand all this, but is there any camera out there that supports this kind of setup out of the box? Or do I have to roll my own if I want to do this?
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by Sohcahtoa82 on Sunday October 27, 2019 @05:04PM (#21372385)
No idea. You'd probably have to roll your own.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by nullc on Thursday October 24, 2019 @02:49PM (#21347881)
> Storing videos locally wouldn't support that.

Sure it does.

The Internet is a global wide area network that connects computer systems across the world.

Perhaps you got confused and thought that the internet only connected you to Amazon? :)

Smarm aside, I really wonder how you ended up thinking this?

You're not the only person I've encountered that seemed to think cameras had to upload 'to the cloud' to be useful. E.g. after posting cute animal footage from my cameras ( https://people.xiph.org/~greg/troups.webm ) I got a number of comment from people along the lines of being surprised that I'd hand footage of my home over to amazon which made no sense until I found out about how ring worked.

This is quite surprising to me, because the bandwidth involved and the requirement for working internet connectivity makes remote storage seem really costly and unattractive to me and I was surprised to learn that's what products like ring were doing.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Friday October 25, 2019 @12:26AM (#21351876)
> Perhaps you got confused and thought that the internet only connected you to Amazon? :)

Please save your patronizing for someone else.

> You're not the only person I've encountered that seemed to think cameras had to upload 'to the cloud' to be useful.

I've explained exactly what I think the issue is, and a number of people have given useful responses. You haven't.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Friday October 25, 2019 @12:29AM (#21351893)
> the bandwidth involved and the requirement for working internet connectivity makes remote storage seem really costly and unattractive to me

If the camera doesn't have internet connectivity, I can't see what it's seeing when I'm away from home. That's a requirement, as I have already said.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by nullc on Friday October 25, 2019 @05:32AM (#21353260)
I can see my cameras just fine when I'm away from home.

But they also keep recording while my internet connectivity goes out.

My cameras in aggregate also produce a lot more data than my internet connection could support-- about 180mbit/s during the day-- but that presets no problem for remote viewing because I only few a couple cameras at a time remotely. (I also can view the much lower bitrate substreams, while the full resolution is recorded locally.)

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by jMyles on Saturday October 26, 2019 @09:41PM (#21367409)
Can I ask what solution you use? ZoneMinder or something else?
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by input_sh on Thursday October 24, 2019 @02:03PM (#21347343)
Even if we ignore privacy implications, doesn't Ring seem a little... inefficient?

Having all of your cameras constantly uploading stuff to someone else's computer so that you could use your own client device (presumably, a smartphone) to look at a copy of stored videos (or a live feed) from someone else's computer? Wouldn't it be a bit more efficient to skip a step and stream straight from a computer within your home?

It really boggles my mind why anyone tech-savvy would not only agree to this ineffective approach, but also pay a monthly subscription for that service.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Thursday October 24, 2019 @02:30PM (#21347655)
> Wouldn't it be a bit more efficient to skip a step and stream straight from a computer within your home?

Not if I'm away from home and can't talk directly to that computer because it's behind a firewall and my ISP won't let me run Internet-visible servers using my home Internet connection. (And even if the ISP would, while I, as a techie, might be willing to set up my own streaming server and poke a hole in my firewall for it, I'm not sure the average user would be able or willing to do that.)

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by input_sh on Thursday October 24, 2019 @03:59PM (#21348582)
To quote myself:

> It really boggles my mind why anyone tech-savvy...

I wasn't talking about average users.

> and my ISP won't let me run Internet-visible servers using my home Internet connection.

I'll give you that one. I know that Google Fiber has an exception for such use cases. From: https://support.google.com/fiber/answer/2659981?hl=en&topic=...

> However, personal, non-commercial use of servers that comply with this AUP is acceptable, including using virtual private networks (VPN) to access services in your home and using hardware or applications that include server capabilities for uses like multi-player gaming, video-conferencing, and home security.

I know that other ISPs in the US are somewhat shittier in this regard.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by ryandrake on Thursday October 24, 2019 @07:11PM (#21350127)
Some ISPs will say they don't "support" or "allow" it in their legalese, but it's just words they never enforce. It seems ridiculous to me as a customer to have an Internet connection yet only use it for outbound connections, and I've never had a problem running public-facing services on my "consumer grade" home connection.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by ajross on Thursday October 24, 2019 @02:31PM (#21347689)
Security camera video is much lower bandwidth than you might think. Most of the time the scene isn't changing and compressed almost perfectly.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by nullc on Thursday October 24, 2019 @04:34PM (#21348871)
It's still video-- unless you want to seriously compromise on quality or frame rate it's an outdoor camera will use decent amount of bandwidth. (I agree an indoor security camera with no view of a window can be awfully low bitrate).

Looks like my cameras, all outdoor, average about 7mbit/sec each-- most of my cameras are 2 or 4mpixel ones though the number is inflated by a couple 12mpixel wide angle cameras. I'm sure I could tune the bitrate a bit more if I tried, but already I turned them down until just before there was a noticeable reduction in face intelligibility at the end of their range.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by f-securus on Thursday October 24, 2019 @01:52PM (#21347226)
I mean... you can store videos locally and then access them over the internet while managing all of the hardware/software yourself. Though, that is another layer of complexity the average user won't be bothered with. People trade privacy for convenience.
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by pdonis on Thursday October 24, 2019 @02:30PM (#21347667)
> that is another layer of complexity the average user won't be bothered with.

Yes. Plus ISPs (or at least US ones) won't allow you to run an Internet-visible server using your home Internet connection.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by JohnFen on Thursday October 24, 2019 @04:18PM (#21348736)
> Plus ISPs (or at least US ones) won't allow you to run an Internet-visible server using your home Internet connection.

That's not entirely the case. I've been running internet-visible servers from home for decades. My current ISP (Comcast) doesn't have a problem with that, even contractually, as long as you aren't running publicly available services, and I've never had a problem with any of my prior ISPs.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by cgriswald on Thursday October 24, 2019 @03:16PM (#21348174)
In practice I’ve never had a problem with running any server on my home connection except an SMTP server which required me to ask them to open the port directly (and they did).

Most ISPs don’t seem to care if you’re not using a ridiculous amount of bandwidth. Many will sell you a package that explicitly allows it. I currently have access to live view and recorded video from my security system and haven’t had any problems at all.

In the case of wide adoption of such a thing I imagine the ISPs either offering a more expensive package, or clamping down and offering their own version of the service through some monstrosity of a modem/router. It’s probably the latter that motivates most of these companies to use “the cloud”. There’s certainly ways around the problem for a motivated company, though.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by Sohcahtoa82 on Thursday October 24, 2019 @08:29PM (#21350576)
I've run plenty of internet-visible servers (HTTP, Mumble, Ventrilo, SSH, various game servers) on Comcast, Verizon, and Frontier and never had an issue.

The ToS says you can't, but it isn't enforced.

Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by f-securus on Thursday October 24, 2019 @03:08PM (#21348092)
If you change the port used, is it considered 'internet-visible'?
Re:Ring Gave Police Stats About Users Who Said No to Law Enf... by blotter_paper on Thursday October 24, 2019 @01:57PM (#21347281)
The live feed should work more efficiently with local storage (by going directly to the user rather than getting routed through a man-in-the-middle first), and the recorded video would be available in any situations where the live video is (though perhaps over a worse connection than Ring's servers have).