documentation technical

news/blog

technology software

forum

news

English

Within the informational generic top-level domain (.info), 'palant.info' is registered with no subdomain. Count 6 characters in 'palant' with two vowels and four consonants. It segments into one word: palant. No strong language cues emerged from the frequency lists.

html/44/9d/449d6a72-f0b1-4de9-b363-4b46a67e31a0_fallback.html.gz

An overview of the PPPP protocol for IoT cameras | Almost Secure

name

email

message

html/44/9d/449d6a72-f0b1-4de9-b363-4b46a67e31a0.html.gz

default-src 'self' ; script-src 'self' 'sha256-iWsvAf4EmEZEHwwJK/TWHx6oxr+9mEXRaiEgdeWhRmw='; object-src 'none'; style-src 'self' 'unsafe-inline'

189f003c5e5e61d67b15e5a112beedc7746551027268644b9925330d19e48fd6

previous article on IoT “P2P” cameras

has the interesting string “Charlie is the designer of P2P!!” in its codebase

public implementation of this “encryption”

generator

theme-color

color-scheme

viewport

telephone=no, date=no, address=no, email=no

format-detection

author

My previous article on IoT “P2P” cameras couldn’t go into much detail on the PPPP protocol. However, there is already lots of security research on and around that protocol, and I have a feeling that there is way more to come. There are pieces of information on the protocol scattered throughout the web, yet every one approaching from a very specific narrow angle. This is my attempt at creating an overview so that other people don’t need to start from scratch.
While the protocol can in principle be used by any kind of device, so far I’ve only seen network-connected cameras. It isn’t really peer-to-peer as advertised but rather relies on central servers, yet the protocol allows to transfer the bulk of data via a direct connection between the client and the device. It’s hard to tell how many users there are but there are lots of apps, I’m sure that I haven’t found all of them.
There are other protocols with similar approaches being used for the same goal. One is used by ThroughTek’s Kalay Platform which has the interesting string “Charlie is the designer of P2P!!” in its codebase (32 bytes long, seems to be used as “encryption” key for some non-critical functionality). I recognize both the name and the “handwriting,” it looks like PPPP protocol designer found a new home here. Yet PPPP seems to be still more popular than the competition, thanks to it being the protocol of choice for cheap low-end cameras.
Disclaimer: Most of the information below has been acquired by analyzing public information as well as reverse engineering applications and firmware, not by observing live systems. Consequently, there can be misinterpretations.
Update (2025-11-07): Added App2Cam Plus app to the table, representing a number of apps which all seem to be belong to ABUS Smartvest Wireless Alarm System.
Update (2025-11-07): This article originally grouped Xiaomi Home together with Yi apps. This was wrong, Xiaomi uses a completely different protocol to communicate with their PPPP devices. A brief description of this protocol has been added.


description

apple-mobile-web-app-capable

apple-mobile-web-app-title

apple-mobile-web-app-status-bar-style

mobile-web-app-capable

application-name

msapplication-starturl

msapplication-TileColor

msapplication-TileImage

twitter:card

An overview of the PPPP protocol for IoT cameras

https://palant.info/2025/11/05/an-overview-of-the-pppp-protocol-for-iot-cameras/

https://palant.info/icons/apple-touch-icon.png

fediverse:creator

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

✅ Low Risk - https://palant.info/2025/11/05/an-overview-of-the-pppp-protocol-for-iot-cameras/

Requests	IP Address	Location	AS Autonomous System
6	94.130.151.233	Nuremberg, Bavaria, Germany	AS24940Hetzner Online GmbH
5	2a01:4f8:c0c:3e12::2	Germany	AS24940Hetzner Online GmbH
11	2	-	-

Security Scan Report: palant.info

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History