How Camlane keeps your cameras yours
What protects your phones, your stream and your recordings today, what isn't protected yet, and how to report a problem.
Camlane is built for a network you trust: your home or office Wi-Fi, or a hotspot between your own devices. There is no Camlane server and no cloud. Everything below happens between your own phone and your own computer.
Pairing: a PIN that never crosses the network
- The PIN. The desktop app shows a 6-digit PIN. The phone doesn’t send it. Instead, the computer sends a fresh random challenge (32 bytes) for every connection, and the phone answers with an HMAC-SHA256 of that challenge keyed with the PIN. The computer checks the answer. Someone watching the Wi-Fi sees the challenge and the answer, never the PIN, and an old answer is useless for the next connection.
- Guessing is slow. Five wrong attempts per minute from one address, then a wait. At that rate, trying every 6-digit PIN would take about three months, and the PIN changes every time the desktop app restarts.
- After the first time: a pairing token. Once the PIN is right, the computer gives the phone a random 32-byte token. Both keep it, and later connections prove it the same way, with an HMAC of a fresh challenge. You don’t type the PIN again.
- Forget a device. On the phone, long-press a computer to forget it. On the computer, revoke paired phones from the Pairing page. Do this when you sell or lend a phone.
- Viewers pair too. A computer that watches another computer’s cameras pairs once with that recorder’s PIN and gets its own token. The recorder lists its viewers, and you can forget them one by one.
What a phone shows
- Recording. A phone that is being recorded shows a red “Recording” pill on its camera screen, and its notification starts with “Recording.”, so it shows with the screen off too.
- Talking. While someone talks through it, the phone shows who is talking.
- Streaming. Android’s own camera and microphone indicators show whenever Camlane uses them.
Recordings: encrypted at rest
- AES-256-GCM. Every one-minute piece of a recording is encrypted with a random 256-bit key, created on your computer the first time it records. Encryption is on by default.
- The key lives in your keyring. Secret Service on Linux, Keychain on macOS, Credential Manager on Windows. On a computer without a keyring (a headless Linux server), it’s a file only your user can read, or it’s derived from a passphrase with Argon2id.
- Back it up. Settings → Recording → Back up key shows the key so you can store a copy. Without the key, recordings can’t be opened, by anyone.
- What it protects against. A copied recordings folder, a stolen external drive, a backup that ended up somewhere it shouldn’t. It doesn’t protect against someone using your signed-in account on that computer, because the app can read the key then.
- On camera phones. A phone in Camera mode that records on itself encrypts each second with a key in the Android Keystore that never leaves the phone.
- Private AI data that describes a person (face templates, names, tags, notes) is encrypted with the same recordings key.
What isn’t encrypted yet
Be clear about this before you use Camlane on a network you don’t control:
| Today | |
|---|---|
| The PIN | Never sent |
| The pairing token | Sent once, when the PIN is first accepted; never again |
| The live video and audio between phone and computer | Not encrypted |
| Settings and status messages between phone and computer | Not encrypted |
| Recordings on disk | Encrypted (AES-256-GCM) |
Someone already on your network with packet-capture tools could see the live stream. So:
- Don’t use Camlane on public Wi-Fi or networks you don’t trust. A hotspot between your own devices, with a strong password, is fine.
- Never forward Camlane’s ports (TCP 47393, UDP 47392) from your router to the internet. To watch from elsewhere, connect to your home network with a VPN you control.
- Encrypting the live stream with the pairing token is planned. Remote viewing, which is coming, is end-to-end encrypted from the start.
What Camlane connects to
Video and audio never leave your network. Only these requests go to the internet:
| App | Where | When |
|---|---|---|
| Android app | Google’s ad servers | When online, for the banner ads. Never camera, microphone or stream data |
| Desktop app | raw.githubusercontent.com |
At most once a day, a plain request for the sponsor strip, with no cookies or identifiers |
| Desktop app, Private AI | huggingface.co, github.com |
Only when you choose Install for a model |
camlane-cli |
None |
The sponsor strip is treated as untrusted: it’s shown as plain text, opens only https:// links when you click them, and a bad file means no strip, never a crash.
Good habits
- Keep the PIN on (the default). “Accept anyone” is only for an isolated network you fully control.
- Revoke paired phones when you lend or sell one.
- Install Camlane only from camlane.live/download or Google Play, and check downloads against the SHA-256 on the builds page.
- Keep both apps up to date. Fixes land in the latest release only.
Report a security problem
Email hello@camlane.live with “Security” in the subject. Describe the problem, which app and version it affects, and how to reproduce it. Please don’t post it publicly before it’s fixed: we’ll acknowledge within 3 working days, agree on a fix window (90 days by default), and credit you in the release notes unless you’d rather not be named.
In scope: the Android app, the desktop apps and camlane-cli, how devices pair and talk to each other, the release files, and this website. Out of scope: drivers you install separately (v4l2loopback, OBS, VB-Cable, BlackHole), the Google Mobile Ads SDK, your router and the operating systems themselves; please report those to their makers.