When a Home Camera Company Watches Your House

A home camera company watches your house when the picture has to live on its computers for the product to work. Ring sold that product as peace of mind. On May 31, 2023, the Federal Trade Commission said the company had compromised customers' privacy: any employee or contractor could access private videos, and weak account protections let hackers take control of cameras. The proposed order called for $5.8 million in consumer refunds and for deletion of data products built from video the company had reviewed unlawfully. This page is about that record, and about the local ESP32 camera that does not put the same loop on a vendor server.

The reporting started earlier. In January 2019, The Verge wrote that Ring had given teams access to customer video on company servers, including a store of recordings and, according to sources, live views. Ring disputed the livestream claim. The FTC complaint, four years later, did not need that dispute. It said the company failed to restrict who inside the firm could open customer video at all.

What a home camera company could open

Ring's own marketing, as the FTC described it, put an indoor camera in a child's bedroom and told buyers they could see the home from away. The picture in the ad is the product. The computer that holds the picture is the company's.

Employees, contractors, and the recordings

The complaint says one employee, over several months, viewed thousands of recordings from female users, from cameras pointed at bathrooms and bedrooms. He was stopped when another employee noticed. After Ring narrowed who could open videos, it still could not say how many other people had looked, because it had not built the basic record of access. A home camera company that cannot answer "who watched" has already lost the argument that the video was private.

Until January 2018, the FTC said, Ring did not adequately notify customers or get consent for extensive human review of those recordings, including review used to train algorithms. The right to use recordings for "product improvement and development" was buried in terms and a privacy policy. A home camera company can call that product improvement. The videos were still of people's rooms.

The indoor camera, sold as peace of mind

The same complaint says indoor cameras were marketed with the line "See your home. Away from home," next to a picture of a camera watching a child's bedroom. That is the promise a home camera company makes when it wants the nursery, the bedroom, and the hallway on one account. The account is the lock. If the account is the company's, the company is inside the room whenever the video is.

A local camera can still be watched by someone you did not invite. The difference is where the bytes go. A smart home without the cloud is the argument for keeping them in the house. When a baby monitor camera leaves the nursery is the older public case, where the feeds themselves were posted on the open internet.

What the account let strangers do

The FTC said Ring knew about credential-stuffing and brute-force attacks on accounts in 2017 and 2018, including warnings from its own employees, outside researchers, and news reports, and did not put common defenses such as multifactor authentication in place until 2019. Even then, the agency said the rollout was sloppy enough to blunt the protection.

About 55,000 accounts

Hackers reached stored videos, live streams, and account profiles of approximately 55,000 U.S. customers, the complaint says. A home camera company that stores the archive and the live view in one login has made that login the front door. Stealing or guessing the password is enough. The camera does not have to be rewired.

Two-way talk in the room

The same attackers used the cameras' two-way talk to harass, threaten, and insult people in the rooms, including older people and children. The FTC described racist slurs aimed at children, sexual propositions, and a family told they would be hurt if they did not pay a ransom. That is what a speaker in a vendor camera is for, turned around. A home camera company sold the speaker as a way to talk to a delivery person. The public record says it was also a way for a stranger to talk into a bedroom.

This page will not pretend a local board already replaces that speaker. Speaker playback through a codec chip has not been measured here. The harm in the complaint came from a path the vendor built on purpose: an account, a stored video, a live view, and a microphone in the room that the account could open.

What a local ESP32 camera keeps in the house

dldeploy's camera is a different shape. rusty_esp_video serves a page on the LAN. The mesh, when the board can run it, is iroh through rusty_esp_iroh, dialed by public key. The device mints its own did:mata and an owner adopts it with rusty_esp_mid. A home camera company is not in that loop, because there is no account of ours that can open the picture.

The page that has actually run

On a Seeed XIAO ESP32-S3 Sense, the camera page, the porch camera with a microphone, and the mesh camera have run their tests on the board. The mesh subscriber in the verified run was a laptop client, not a polished home app. The camera page answers 403 without a token tied to the device. Sharing the Wi-Fi is not the same as being allowed to look. Deploy an ESP32 at home in an afternoon is that sequence. Choosing an ESP32 board is why a 4 MB board never runs the mesh node itself and reaches it through a bridge.

A home camera company still wins the brochure on one point: the picture on a phone from another city. Off-LAN reach for these boards is written for the PSRAM tier and not timed. Until a board has done it, this page does not offer it.

What this page will not claim

The home computer's media controller is not wired to a Janus stream. Smart home access on your home computer says that in plain words, and the MATA Home integration is the seam being built, not a finished screen. Development firmware can still keep the identity key in a plaintext partition. After adoption, a device can still advertise itself as free to claim, because that record is composed once at boot. There is no C in our crates. The radio underneath is still Espressif's, on ESP-IDF.

A home camera company makes its money by holding the video. The FTC's order, as proposed, would stop Ring from profiting off video it accessed unlawfully and would make it delete models built from that review. The local alternative does not need that order to forget a server, because the measured path never uploaded the hallway. The See vision is the camera half. The Own vision is the key half. The Learn index is the list of which rows are timed.

The computer that should hold the view, when the wire exists, is MATA. The crates are Remade With Rust. A home camera company is the other choice: the picture leaves, and the people who run the picture can look.