https support for remote access

[brdrx]

Given that this is a security product, I was surprised that the remote access for this software uses regular http and not https.
Are you planning to support https access in a future release?

[Devin]

Hi brdrx,

Remote access is a very young part of Sighthound Video and does currently use basic auth which is no different for users who would normally forward their IP cameras out of their network. We are always looking to improve the app and HTTPS is on the list of features that we are investigating and hope to include in a future build.

Regards,

-Devin

[brdrx]

Hi Devin,
Glad to hear that it's on the list.
Cheers,
Hagen.

[nza]

It is true that ip-cameras normally use http, but I can tunnel all my ip-cameras through https (I use stunnel).
Sighthound I cannot get to work, when tunneling it through https though.

So native support for https would be highly appreciated

[luma]

Hi brdrx,

Remote access is a very young part of Sighthound Video and does currently use basic auth which is no different for users who would normally forward their IP cameras out of their network. We are always looking to improve the app and HTTPS is on the list of features that we are investigating and hope to include in a future build.

Regards,

-Devin

We're now a year into the future. As the OP correctly points out, Sighthound is a security product. Anyone that is able to capture an authorization request packet, even just once, is then gifted full admin access to cameras inside and around my home. This doesn't fit the bill for "security products". Enabling remote access to this tool makes me less secure, and it shouldn't, because this should be an easy problem to solve.

Packaging a valid SSL cert with the product isn't feasible, as you've pointed out in another thread. Generating a self-signed cert during installation comes with it's own problems, it isn't terribly secure, and is increasingly difficult to use from mobile platforms anyway. One solution would be to allow Sighthound to generate a CSR and then allow the user to upload the signed certificate issued by a trusted CA. This approach would allow the local OS to use it's secure store to hold the private key material. Alternately, just let me import a user-generated PEM which will save you almost all of the work in the generation process.

In any case, opening Sighthound as it stands for remote access is a terrible idea as there is nothing at all preventing an evesdropper from grabbing your credentials.

[Dimitri]

Wouldn't the easiest solution just be to use remote desktop software?

LogMeIn, for example, allows remote access to a Windows or Mac computer, from any computer (including from your Android phone/tablet).

Or, for a free solution, there's Google's Chrome Remote Desktop. It too allows remote access to your Windows or Mac computer (including from your Android phone/tablet).

The picture won't be perfect, but it's something you can do now... and it's securely encrypted.

Dimitri

[luma]

I wanted to say I'm glad to see SSL support enabled in 3.0! Some digging through the log files gave me a sense of how this was being generated, and with a little hacking I've managed to insert a free cert from StartSSL into Sighthound's web services. At this point I have a valid, secured web interface. Thanks so much guys!