Logging peer IPs to a log

[joseph_1979]

Can you ask the appl dev team to try to add the logging of the remote IP together with the timestamp in a list which the customer can check? A list of the last 20 accesses shall suffice.

[Reolink Fiona]

@joseph-chircop_497308027822318
Thank you for the suggestion. I will try to convey your suggestion.

You can also check the IP address of the current users on the Client. Setting->User management

[joseph_1979]

@reolink-fiona I am aware of this. We need a list so we can check who has accessed the camera. And it should be read only abd cannot be modified or deleted not even by the admin.

[Reolink Fiona]

@joseph-chircop_497308027822318 I will try to tell this to our tech to seek possibilities.

[joseph_1979]

@reolink-fiona This week we heard about what happened to Amazon Ring where employees were spying on customers and able to access customers cameras without their consent.

I have raised a number of points (scroll down) of how to improve security on the camera itself. Customer need to feel their cameras are very secured and being notified whenever an unauthorised user gain access.

[vigy_591093180735512]

Hello. This idea is interesting. Can I add some suggestions? Maybe this could be a part of something bigger, like a "security" tab/page. It could contain access control based on IPs or subnets, maybe automatic logoff time settings, options of loggins IP addresses - how many, send login/logoff notifications via email or push or upload to ftp as a file, camera settings modification alerts (basically audit log), etc...

[joseph_1979]

@vigy_591093180735512 There are a multitude of security features which can be added. I have passed the following to the Reolink support for consideration.

Having the username/password credential is not enough and I propose the following for your evaluation.

1. Introduce 2FA which definitely provide another layer of security fir cloud account. This has already been implemented in RING, Wyze, etc. Introduce it as an option and let the customer to activate it or not.....This has been implemented.
2. Introduce a log of the source IP logging on to the camera. Have the last 20 IPs together with timestamp logged and exposed them to the customer.
3. Send a push notification or email when user fails to log to the camera. In additional to the account locked feature.
4. Add a read only Audit log which captures all the changes made by the Admin. To include timestamp with each change made.
5. Add the possibility to send a push notification when a user logs the camera. Leave it to the customer to activate/deactivate the feature
6. Add a privacy shutter which inhibits any recording. This must be password protected and administered by the admin.
7. Introduce a heartbeat feature with changeable timings where a push notification or an email is send to the customer at specified regular intervals. Or else have the heartbeat mechanism be implemented with your servers and if this is not received for say 5 consecutive times, a push notification or an email is forwarded to the customer. This will definitely entails to augment the number of servers at your end and so option 1 is more favorable.  
8. Encrypting the mp4 files in the SD (using AES 128/256bits or 3DES) and files can only be viewed from the Android/Ios/Windows applications using the combination of UID and password of the camera. Then if the customer wants to pass this video to police then it can be exported with no protection.
9. Camera to send its IP in an email if it changes. Say camera has been stolen. Both public and private IPs are stored in the P2P servers but definitely you won't disclose it.

WE NEED TO BE PROTECTED