URL Generator feature security concerns
So anyone with access to a computer running SecuritySpy can open the URL Generator window and get a URL for a camera stream WITH AUTHENTICATION that they can then use to access your cameras from a different location or device. There doesn't seem to be a way to secure it with a password like you can with the preferences menu. This is an incredible security oversight. Am I missing something here?
It is also crashes the entire program anytime I select Internet for Client location.
This really needs to be password protected like the preferences menu is.
Comments
-
This isn't an oversight - we considered this while designing this feature. These URLs give access to live video only, which is what someone with physical access to the Mac has anyway by simply opening a video window. I don't think your suggestion is unreasonable though - perhaps it's a good idea to add the password protection anyway, just to add that extra layer of security. It would be good to get other users' feedback about this, so anyone else reading this please let us know what you think.
The crash you mention is due to an unfortunate bug, which should be now fixed in the latest beta version of SecuritySpy (currently 5.5.1b8). Please confirm.
-
I downloaded it and it has fixed the crashing issue. It also looks like you added a password requirement for authentication, which is appreciated. While I know people would have access to the video windows from the computer anyway, someone could just create a URL and email it to themselves and would have remote access to video feeds without the owner knowing, unless they were checking things like the logs much more closely. There are certainly instances where businesses might not have any issue with an employee having access to all the camera feeds during their shift, but wouldn't want them to have access after business hours or once they're no longer working there, which without it being password protected would be possible. Plenty of other scenarios similar to this., or worse.
-
You make some good points. Yes, we have now added password protection for this in the latest beta version, which will therefore be in the next official update.
