New cameras from Netgear-Arlo
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
And even then, through the use of other technology, a direct link between the viewer and the camera can be made using the proxy host, so the stream never actually goes to the proxy host, just like how Skype used to work before they converted to centralized nodes.
How does this work? How does this bypass opening the firewall?
As I understand it, the proxy sends the IP/port of camera to the viewer and the IP/port of the viewer to the camera, then those two each send the other a directed packet on the IP/port as indicated. The NATing firewall will create typical NAT temporary rules to allow the responses to what what is now considered an internally generated request.
That's exactly what @JaredBusch had described.
-
@Dashrender said in New cameras from Netgear-Arlo:
I suppose it's wrong to say no ports are open, but they are open only to IP of the other guy, just like when you are surfing a website.
Not sure how to do that in such a way that it would be the same.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
I suppose it's wrong to say no ports are open, but they are open only to IP of the other guy, just like when you are surfing a website.
Not sure how to do that in such a way that it would be the same.
Right, see @Dashrender you are clearly not understanding how NAT works.
Your router creates a NAT translation to a website because the website is open and accepts all connections. So the return packet is mapped to come from that system.
All the proxy does in regards to your camera is tell your phone what port to connect to on what IP after your camera opens it with UPnP or a UDP Punching.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
And even then, through the use of other technology, a direct link between the viewer and the camera can be made using the proxy host, so the stream never actually goes to the proxy host, just like how Skype used to work before they converted to centralized nodes.
How does this work? How does this bypass opening the firewall?
As I understand it, the proxy sends the IP/port of camera to the viewer and the IP/port of the viewer to the camera, then those two each send the other a directed packet on the IP/port as indicated. The NATing firewall will create typical NAT temporary rules to allow the responses to what what is now considered an internally generated request.
That's exactly what @JaredBusch had described.
What? No it's not. I'm not sure exactly what he's saying, but he's not saying what I'm saying at all.
In our private conversation, JB was saying that the vendor wouldn't accept the streams running through their servers due to bandwidth costs that consumers wouldn't pay for.
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
Instead, from what I can tell, you install a camera at home, the camera uses UPNP to punch a hole in the firewall that is open to the world. Anyone port scanning that IP would find the open port and be able to attempt to connect to the camera.
Just look at www.insecam.org. These cameras are just streaming to the world, anyone can connect directly to them, if you know the IP address.
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
Now maybe what you're telling me is - is that all these cameras really do have proxies, and those proxies don't have username/passwords setup on them at all, or at minimum they are defaults, I suppose that's possible,
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
Really? You think these cameras are sending more HD data than Netflix? that would be interesting to know... I really doubt it.
I said less, not more.
And JB said more, not less.
I said more if they were all broadcasting and being actively viewed, yes. Sadly many of them are being actively viewed by various sites.
-
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
-
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
-
@Dashrender said in New cameras from Netgear-Arlo:
Now maybe what you're telling me is - is that all these cameras really do have proxies, and those proxies don't have username/passwords setup on them at all, or at minimum they are defaults, I suppose that's possible,
No, I think what we are saying is.... we are unaware of such proxies.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
-
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
-
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
How, how does a third party help unless the third party is hosting the data stream at enormous cost?
-
@JaredBusch said in New cameras from Netgear-Arlo:
This is exactly what I am talking about - and yes I know it requires a third party.. but the expense is so low that something like $1 a device sold will probably cover the costs of keeping it online for ages.
-
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
Right and I told you they wont do it. Sure the odd company may (possibly nest), but most certainly will not for very simple reasons. It costs money to pay for bandwidth.
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
Yes, point to point with firewalls open via UPnP. Just as Jared has been describing. If Skype is your example, I think Jared is de facto correct. Skype doesn't meet the qualification that you are looking for unless I'm missing something big about Skype.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
How, how does a third party help unless the third party is hosting the data stream at enormous cost?
As I said, the stream never flows through the third party.. the proxy is only there to enable the endpoints to create a point to point connection.
-
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
Yes, point to point with firewalls open via UPnP. Just as Jared has been describing. If Skype is your example, I think Jared is de facto correct. Skype doesn't meet the qualification that you are looking for unless I'm missing something big about Skype.
NO!
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
In the old days Skype was point to point, the skype servers only served as a directory so users could find each other. But after their contact information was passed to each other through the proxy, the Proxy was no longer part of the conversation, therefore the fed couldn't easily intercept the and monitor the traffic.
Yes, point to point with firewalls open via UPnP. Just as Jared has been describing. If Skype is your example, I think Jared is de facto correct. Skype doesn't meet the qualification that you are looking for unless I'm missing something big about Skype.
NO!
Yes. You are incorrect in how you think Skype worked.
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
@JaredBusch said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
So sure, while it's possible JB could have been implying that vendors could setup a connection via proxy like I described - if that was really happening, we wouldn't have devices getting taken over because those cloud providers would (god I hope) require the user to setup an account that would be used to link their camera too.
You described ports being open. Which is what Jared had said. Those were the two things that I was putting together.
He thinks there is some way for them to not be open publicly without going through a third party. There is not.
NO I'm NOT! I am talking about using a third party 100% of the time!
How, how does a third party help unless the third party is hosting the data stream at enormous cost?
As I said, the stream never flows through the third party.. the proxy is only there to enable the endpoints to create a point to point connection.
If the stream is not from the third party, then it is UPNP or UDP Punching, and those are open to the world.
-
@Dashrender said in New cameras from Netgear-Arlo:
@scottalanmiller said in New cameras from Netgear-Arlo:
@Dashrender said in New cameras from Netgear-Arlo:
My solution completely short circuits this by requiring your to log into the proxy host, then have the handshake solution I mentioned above. The firewall will never have general for anyone port open.
It's this proxy thing that I don't understand. Who has a proxy like this and how does it work?
Skype did for years, until just before MS bought them and changed their system to a centralized one.
Skype specifically used UDP Hole Punching...
http://www.h-online.com/security/features/How-Skype-Co-get-round-firewalls-747314.html
