12.4 Cameras, Locks, and Privacy Controls
How Camera Streams Leak
A network camera speaks RTSP: a client sends DESCRIBE to pull the stream descriptor, SETUP to negotiate transport, PLAY to start it, and H.264 video arrives as RTP -- over UDP or interleaved on the same TCP connection, typically port 554. Authentication, when present, is HTTP-style Digest against a device account; countless units ship with admin and an empty password, and many DVR firmwares keep a hidden support account that no UI can remove. ONVIF's WS-Discovery chases them across subnets, while internet crawlers sweep global port 554 daily -- an RTSP service exposed on the WAN is, within days, a live stream in someone's catalog.
Local NVR and No-Cloud Recording
Keeping video on your own network changes the custody story: the camera pushes its RTSP stream to a LAN NVR, clips land on local disks, and the vendor never holds a frame. Pick an NVR whose app can work on-LAN without a relay, encrypt or at least physically secure the drive, set retention to what you actually need, and confirm the NVR itself accepts no port forwards -- a secured camera behind a WAN-exposed recorder is theater.
Rules for Remote Viewing and Smart Locks
You do not need the WAN door to watch from outside: terminate WireGuard or OpenVPN on your router, join the trusted VLAN, and view the NVR as if you were home. Keep the camera's own default-deny posture from the segmentation rules intact. Smart locks deserve the same treatment -- remote-unlock cloud APIs are the riskiest feature in the product, so prefer local PIN or keypad codes, disable remote release unless truly needed, and patch, because BLE pairing flaws and replayed radio codes are real unlock paths.
Physical Kill Controls
Software toggles fail with the firmware that runs them. A slide shutter blocks the lens at the glass; a hardware mic-off switch cuts the microphone's signal or power line rather than setting a flag; a smart plug can cut standby power entirely. For a bedroom camera, the only settings you can audit with your eyes are the mechanical ones.
Architecture Diagram
Key Takeaways
- RTSP video is plain client/server on port 554; weak or hidden default accounts are the main lock on your footage.
- Any RTSP or DVR HTTP service reachable on the WAN will be found by crawlers and cataloged quickly.
- A local NVR with no cloud relay keeps custody of your video; never expose the NVR itself to the WAN.
- View remotely through a VPN into the trusted VLAN, and treat cloud unlock as a smart lock's riskiest feature.
- Trust mechanical shutter, hardware mic-off, and power cuts over software toggles you cannot audit.