Reading · Ready Room · RSS Amplifier

Alright, I’ve tried a few different formats over the last 6 months of experimenting with the Youtubes, but long form essays is my sweet spot, so I’m going to use this page to track extra content that I couldn’t fit into a video, my notes and references.

Enjoy the video and please like, subscribe, share and comment!

Fairly standard privacy invading stuff here, but I found it interesting that they claim not to share with 3rd parties, but their privacy policy contradicts this.

Here is their privacy policy: https://qin.tuyacn.com/app-agreement/en/979367405/v1.0.0/1/smart/app/package/979367405/privacyUrl_1654071894161.html

As mentioned in the video, it is a copy and paste with very little changed. This is par for the course for consumer IoT companies.

Below this contradicts the Google Play Store’s assertion that they do not share data to 3rd parties…

Whoops, forgot to take the boiler plate stuff out!

And while standard verbiage, this company is not based on North America or in the EU, so law government requests have extra cause for concern with a camera and microphone in your back yard!

Their privacy policy lists several categories of potential recipients:

Third-party service providers – hosting, analytics, payments, email, etc. qin.tuyacn.com
“Customers and other business partners” who provide your smart device or the networks you use. That can include Tuya or any retailer/reseller. qin.tuyacn.com
Subsidiaries/affiliates inside Pine Lake’s corporate family. qin.tuyacn.com
Successor entities in a merger or bankruptcy. qin.tuyacn.com
Law-enforcement or regulators under “good-faith” clauses. qin.tuyacn.com

I’d assume this is more boilerplate verbiage, but that also probably means they are going to share it with whoever they like. There is also no opt-out for essential service sharing; you may opt-out of marketing-related processing in the app’s privacy settings, but cloud-side logs, analytics, etc. are not mentioned.

Something I cut from the video was talking about the companies involved.

IsYoung is just packaging and who puts it on Amazon.
Pine Lake is the company manufactures the bird feeder (as far as I can tell), developed the mobile apps, the backend software.
Unknown Smart Camera Company: Since I didn’t open the package I didn’t inspect the camera, but it is safe to assume Pine Lake bought these and flash their own Tuya based software on it.
Tuya is a white label IoT Cloud provider. They are very popular service for this and likely do an OK job, however it is their “customers” who put low-end code on top of the service that are putting consumers at risk.

Given my experience with Smart Home technology and Home Assistant, I am fairly familiar with the different technologies and back end models. They use Tuya as a white labelled back end which is a good option for outsourcing the “meet me” backend service between bird feeder, data store and mobile device. However, there is a shared responsibility model and it is likely that Pine Lake is not pulling their weight, owning a buggy app, storing your data in likely an insecure way and highly likely, little to no security controls to prevent unauthorized access to videos or real-time access to the camera and microphone.

One of my biggest concerns is the immediate and long term sustainability and support of these platforms. Here are a few concerns of mine:

The software is buggy as per customers, which is going to lead me to assume the software is also vulnerable
Are there controls to prevent unauthorized access to videos or the camera/microphone itself?
And who is supporting this? There have been many instances where a company outsources the support and maintenance to a 3rd party who lacks any security controls or accountability, leading to snooping and privacy invasions!