Why do it yourself?
There are good reasons to manage your own security system. Privacy is the most significant, but long-term cost savings and avoiding vendor lock-in are close behind.
There is a common tradeoff between privacy and convenience in software and services. Our goal with StreamShuttle is to close that gap by building security software that is both genuinely easy to use and fully private.
What are you giving up by using a cloud solution?
The biggest concern with cloud-based solutions from the major providers is that sharing your footage with them is a fundamental part of how they work. Recorded events are transmitted to central servers, accessible by the company and its employees. Maybe you trust the megacorps (you know who) or unknown third-party sellers on the big online marketplaces (you know where) to handle that footage responsibly. But do you trust every one of their employees? Can you be sure these companies won't be subpoenaed and compelled to hand over your private footage?
- The privacy loophole in your doorbell
- FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras
- Amazon admits giving police Ring camera footage without consent
- ADT Employee watched customers through cameras for years
- Ring Changed How Police Request Door Camera Footage
Smaller camera companies outside the few big names are often worse. Many route footage through servers outside the U.S., something most consumers are completely unaware of. If the major providers with large security budgets can't be trusted to keep footage safe, there's little reason to expect better from a no-name third party.
There's also a reliability problem with cameras that only upload when "activity" is detected. There is no way to guarantee these cameras will capture every event of interest. Detection works differently across devices, and anyone who has used one can tell you about missed activity or false alarms. The only reliable approach is to record continuously. Many cloud services can't even offer 24/7 recording due to ISP upload bandwidth limits. It might be feasible with one low-resolution camera, but it quickly becomes impractical as more cameras are added.
Future support and hardware security
Companies go out of business or stop supplying security updates for a multitude of reasons, leaving devices open to attack as new vulnerabilities go unpatched. Some cameras have even been found to have deliberate backdoors.
- Hikvision security cameras vulnerable to remote hijacking | Via Packet Storm
- Firmware made by China-based Hangzhou Xiongmai Technology allows for remote access
- Xiongmai backdoor still active
The safest approach is to prevent cameras from accessing the internet at all. Blocking all outgoing connections at the firewall is the only way to be certain.
- Hackers Breach Ring Home Security Cameras
- Are your home security cameras at risk of hacking
- Hackers Breach Thousands of Security Cameras
Cost
Cost is another significant problem with centralized cloud services. The big providers charge monthly fees indefinitely while also requiring their own hardware. Storing footage isn't free, but their fees are generally well out of line with the actual storage costs. Most plans force an upgrade to get any reasonable retention period. You should at least be able to go on vacation for a week without worrying about missing activity. On top of that, very few cloud services allow footage to be stored locally or anywhere the user actually controls.
Vendor lock-in
Vendor lock-in is a serious issue with many of the larger brands. Proprietary hardware is the norm, and if the service is cancelled or the company shuts down, the cameras become useless. Policies change, companies get acquired, and ecosystems get discontinued, often with less functionality than before.
A clear example is what Google did to Nest customers after the acquisition, sunsetting the original app and forcing a migration to a less capable replacement.