[ocdtrekkie]

It really comes down to how it's used. As another commenter pointed out, any company using badges to swipe into doors can track your movements. Most cameras are positioned near entry doors, exteriors, or public areas as it is. The main difference here is the amount of information collected on an unauthorized entrant, and the fact that maybe badge-borrowing doesn't go unnoticed anymore.

I really doubt Cloudflare is the type of company to be tracking where each employee is and whether they are taking too many bathroom breaks. It's definitely an area abuse is possible, but probably not an area it's likely in Cloudflare's case.

[quasirandom]

> It really comes down to how it's used

I absolutely agree. The thing that concerns me is these cameras sitting on the internet. It says something about how overworked the security team is. I trust that they have good faith, but I don't know if they have the resources they need.

[adolph]

What is a specific credible concern about cameras with public API?

[Teknoman117]

People other than the ones you agreed to let monitor you, well, monitoring you. Also, it's a major risk to the company itself, who knows what can be read off of employees screens if they're compromised.

[adolph]

Yeah, it seemed far fetched to me at first but I guess surveillance might be useful to a 3rd party. I read an article a while back on how people make equity trades based on data found through satellite images of refinery tanks and whatnot. I guess unsecured internal surveillance cameras could allow an outsider to find out if a company was really busy or just faking it.

[gostsamo]

Every IOT device is an attack vector against the network.

[adolph]

I wonder if there is a way to dumb down IOT devices so they can’t be an attack vector like that.

[gostsamo]

Lock the memory so that update is physical only and restart regularly to avoid no-memory malware. Not 100% secure and very inconvenient, so people prefer to isolate IOT in its own network and preferably have a good network security like putting the devices behind VPN/firewall/other gatekeeper.

Actually, if you want to have IOT access outside of the network, the best approach is to close all ports and for the device to initiate connection with a control server. The device is dark when scanned while a heartbeat signal will ensure connectivity. This will require a good security on the control server, but that is okay because server security is much better understood and does not suffer from the constraints of the embedded software.

[josefx]

Someone wanting to break in can check if anyone is there or see where easy to steal stuff is kept? Or on a larger scale you might leak when and how security guards make their rounds.