New cameras from Netgear-Arlo
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
And even then, through the use of other technology, a direct link between the viewer and the camera can be made using the proxy host, so the stream never actually goes to the proxy host, just like how Skype used to work before they converted to centralized nodes.
How does this work? How does this bypass opening the firewall?
As I understand it, the proxy sends the IP/port of camera to the viewer and the IP/port of the viewer to the camera, then those two each send the other a directed packet on the IP/port as indicated. The NATing firewall will create typical NAT temporary rules to allow the responses to what what is now considered an internally generated request.
That's exactly what @JaredBusch had described.
What? No it's not. I'm not sure exactly what he's saying, but he's not saying what I'm saying at all.
In our private conversation, JB was saying that the vendor wouldn't accept the streams running through their servers due to bandwidth costs that consumers wouldn't pay for.
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
Instead, from what I can tell, you install a camera at home, the camera uses UPNP to punch a hole in the firewall that is open to the world. Anyone port scanning that IP would find the open port and be able to attempt to connect to the camera.
Just look at www.insecam.org. These cameras are just streaming to the world, anyone can connect directly to them, if you know the IP address.
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
Now maybe what you're telling me is - is that all these cameras really do have proxies, and those proxies don't have username/passwords setup on them at all, or at minimum they are defaults, I suppose that's possible,
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
Really? You think these cameras are sending more HD data than Netflix? that would be interesting to know... I really doubt it.
I said less, not more.
And JB said more, not less.
I said more if they were all broadcasting and being actively viewed, yes. Sadly many of them are being actively viewed by various sites.
-
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
-
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
-
@Dashrender said in New cameras from Netgear-Arlo:
Now maybe what you're telling me is - is that all these cameras really do have proxies, and those proxies don't have username/passwords setup on them at all, or at minimum they are defaults, I suppose that's possible,
No, I think what we are saying is.... we are unaware of such proxies.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
-
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
-
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
How, how does a third party help unless the third party is hosting the data stream at enormous cost?
-
@JaredBusch said in New cameras from Netgear-Arlo:
This is exactly what I am talking about - and yes I know it requires a third party.. but the expense is so low that something like $1 a device sold will probably cover the costs of keeping it online for ages.
-
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
Right and I told you they wont do it. Sure the odd company may (possibly nest), but most certainly will not for very simple reasons. It costs money to pay for bandwidth.
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
Yes, point to point with firewalls open via UPnP. Just as Jared has been describing. If Skype is your example, I think Jared is de facto correct. Skype doesn't meet the qualification that you are looking for unless I'm missing something big about Skype.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
How, how does a third party help unless the third party is hosting the data stream at enormous cost?
As I said, the stream never flows through the third party.. the proxy is only there to enable the endpoints to create a point to point connection.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
Yes, point to point with firewalls open via UPnP. Just as Jared has been describing. If Skype is your example, I think Jared is de facto correct. Skype doesn't meet the qualification that you are looking for unless I'm missing something big about Skype.
NO!
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
Yes, point to point with firewalls open via UPnP. Just as Jared has been describing. If Skype is your example, I think Jared is de facto correct. Skype doesn't meet the qualification that you are looking for unless I'm missing something big about Skype.
NO!
Yes. You are incorrect in how you think Skype worked.
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
How, how does a third party help unless the third party is hosting the data stream at enormous cost?
As I said, the stream never flows through the third party.. the proxy is only there to enable the endpoints to create a point to point connection.
If the stream is not from the third party, then it is UPNP or UDP Punching, and those are open to the world.
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
Skype specifically used UDP Hole Punching...
http://www.h-online.com/security/features/How-Skype-Co-get-round-firewalls-747314.html
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
Yes, point to point with firewalls open via UPnP. Just as Jared has been describing. If Skype is your example, I think Jared is de facto correct. Skype doesn't meet the qualification that you are looking for unless I'm missing something big about Skype.
NO!
You know stuff about Skype that no one else does, then. Where are you getting this information?
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
How, how does a third party help unless the third party is hosting the data stream at enormous cost?
As I said, the stream never flows through the third party.. the proxy is only there to enable the endpoints to create a point to point connection.
That's a nice theory, but where does this exist? Can you come up with any example of such a technology? You keep repeating this but to us it sounds like just "magic" in the middle. Skype wasn't able to do this, why would some random video vendor? How can such a technology work when it goes against the firewalls?
-
@scottalanmiller BTW, I know where he went south on this. He has apparently always thought there was some magic secret sauce to the Skype thing. It is true that the node your went through in old Skype jsut handed off address info, it did not mean that a person form that IP the node was on could not attempt to barge the call if they knew the info from port sniffing after the call was initiated. It is simple UDP/UPNP.
Edit: Skype advertised on their FAQ that the signaling nodes knew nothing about the calls. This was true from the sense that the SKype software that was the node did not do anything to know about the calls.
But he took that to mean that the call was somehow secure point to point which it never was (encryption not withstanding).
