Cameras watch the house. Who watches the cameras?

A camera you can see from your phone is a camera someone else might reach too.

The convenience is real. Glass up the whole house, check the nursery from the airport, see who's at the door from the couch. I build connected offices and homes for a living, so I'm the last person to argue against it.

But a camera you can reach from anywhere is, by definition, reachable from anywhere, and that cuts both ways. The feed that comforts you on a trip travels over the same internet an attacker lives on. The question stops being whether the camera works and becomes who, besides you, can get to it.

The failures I see aren't exotic. A camera still carrying the password it shipped with. An account protected by one you also used somewhere that has since leaked. A sharing link sent to a contractor two years ago that nobody ever turned off. The hard part is rarely the camera. It's the account and the habits around it. source

So the work is boring on purpose. A real password on the account, not the one from the box and not one reused from elsewhere. A second factor on that account, so a leaked password alone isn't enough. A look at who and what the system is sharing with, with everything you don't recognize cut off. Firmware kept current, because camera makers patch the holes strangers are actively looking for.

One more judgment call worth making on purpose: decide which rooms a camera belongs in at all, and whether the footage lives on a device in your house or on someone else's servers. There's no single right answer, but there's a big difference between choosing and defaulting.

The goal isn't to make you nervous about your own house. It's the opposite. Set it up so the only person watching your cameras is you, then stop thinking about it.

← All field notes