[chrisballinger]

Whenever end-to-end encryption is not used, scenarios like these are bound to happen eventually.

As far as I know, the only home surveillance products that use E2EE are ones that support HomeKit Secure Video [1].

1. https://support.apple.com/en-us/HT210538

[izacus]

These kind of scenarios can happen with workers in government offices, archives and medical institutions as well. And yet the paper documents are not E2E encrypted.

Maybe... just maybe... technology is not really what should be the core issue here? But we should perhaps look at our policies and legislation? Adding proper liability there will make technology come by itself. The magic of free market doesn't seem to be working here.

[hinkley]

Any problem is easy if you oversimplify it.

The cultural conceit of 'disruptors' is that society has made everything complicated and therefore society is 'ripe for disruption' which if you read between the lines means 'stupid'. Lack of respect means lack of care. Lack of care leads to injury (theirs, and/or ours).

You are right. It's not the tech. It's the arrogance.

From my knothole, legislation comes for things that aren't policing themselves adequately. I think what we are discovering is that there are a lot of domains where the old guard were self-policing to a degree, and the newcomers have absolutely no reverence for anything.

I expect it won't be long before you'll see industries taking a hard look at their internal culture, and then engaging in regulatory capture to keep out the disruptors.

[coralreef]

The easiest way to keep someone out is to lock the door.

You can create penalties, punishments, hire security guards to watch the door. But the most efficient and effective way is just a lock.

[deogeo]

I'm a strong proponent of both approaches. If surveillance infrastructure is in place, and all you have protecting you is law, it only takes one small change, or one warrant, to lose all your privacy (and you won't even find out about it). On the other hand, if the law forbids privacy, technological solutions won't withstand for very long, especially when you can be compelled to hand over your passwords or face jail.

[thatsenough]

This brought back memories of doing data entry for an insurance company as a teenager. I spent eight hours a day transcribing people's names, addresses, SSNs, and medical ailments, including all sorts of sexually transmitted diseases.

It's weird, now that I think about it. I was just some kid they hired as a temp. We've never really known who's looking at our private data.

[just_myles]

I agree, there should be a legislative intervention here. These devices come out semi-regularly with no regard to security.

[mi100hael]

I don’t know if Ubiquiti’s feeds are streamed encrypted, but at least the recording infra is 100% local and can be accessed locally without any cloud middleman if desires.

[wil421]

Best I could find[1] but I think the forum question is about having a NVR in another site with a VPN connection in between the site and camera.

[1] https://community.ui.com/questions/Are-Unifi-Video-streams-e...

[Wheaties466]

The only product currently out that supports this is the logitech Circle.

https://www.apple.com/ios/home/accessories/#section-camera

[godelski]

Unless I COMPLETELY misunderstand encryption, E2E encryption only protects your data in transit. It does not mean that data on servers are encrypted NOR does it mean that servers don't have decryption keys to that data if it is encrypted.

Am I wrong about this?

[orclev]

Your confusion is around where the end is in this case. E2E would be encryption from the ring device to your other device being used to view the feed (your cellphone for instance). Part of the difficulty in that case is getting the encryption key securely transferred between the two devices without exposing it to anyone else (a non-trivial problem). Assuming that was done in this case Ring employees would only have access to the encrypted videos with no access to the decryption keys to actually view them.

E2E Encryption is usually referenced in messaging applications where the ends are understood to be the two communicating parties, while in this scenario it's a little more nebulous.

[smolder]

In short, yes, because end-to-end implies only a single producer and consumer have access to the data. Storage in the cloud wouldn't be an "end", and therefore it must be encrypted at that stage. The ends are 1) where the data is created by the device, and 2) wherever it is viewed on retrieval by the end user. While it's in the cloud it's still "in transit".

Facebook, if I recall correctly, at one point seemed to be trying to redefine the term to be "encrypted on its way to us and then back out again", which IMO is nothing short of propagandizing to confuse people, I assume to foil demand for real E2E encrypted products and gain unearned trust.

[nerdjon]

At least in Apple's case, they do not have the keys because it is encrypted by your devices and then uploaded. It is then only able to be read by your devices because they have the keys to un-encrypt it.

[nerdjon]

I am curious if there are others.

But as soon as a camera came out that supported this I finally got one (flat out refused to get one before... even though I wanted to get one).

It feels pretty good knowing its stored encrypted in my iCloud and all of the processing happens on my devices (HomePod and Apple TV)

[giancarlostoro]

Wyze has End to End encryption for their cloud stuff, or you can save it all on an SD card instead. Wyzecams are also really cheap $20 but they dont have a doorbell, so for now I'm keeping Ring (came with my house) till I see a good alternative.

[mackey]

Please correct me if I am wrong, but Wyze doesn't actually encrypt the files they store, in their case end to end just means that the files are secure in transmission. Apple secure Video actually encrypts the files so they can't be viewed by Apple.

[smolder]

Wyze is using the term end-to-end wrong, which is very disappointing but not surprising. They are considering themselves an end, which changes the meaning in a way to make the term totally meaningless. The end in end-to-end is end users.

[wmeredith]

How is Ring better than a Wyze cam pointed at your front door? Genuinely curious. I have several Wyze cams but have never interacted with a Ring much other than pushing the bell button at someone else’s house.

[JackRabbitSlim]

Why would end-to-end help when it's the other end that's watching?

[alias_neo]

The other end should be you too?

Unless you intend for someone else to oversee your surveillance operation, your footage shouldn't leave your premises unless encrypted, using keys which don't leave your possession. You enter them out-of-band on the device on which you wish to watch remotely.

Is there some implied benefit to not encrypting end-to-end or are they just being lazy and using nothing more than TLS because security isn't really the goal?

[kylec]

In this context, "end to end" means being encrypted between the camera and the user's devices they use to watch the camera, with the cloud service acting as an intermediary between the two, and unable to decrypt the data.

[SilasX]

Can't wait for (scalable) homomorphic encryption, where providers can serve you without ever knowing what's in your data.