Six Ways to Set Up a Baby Monitor, and What Each One Costs

The thing that finally got me building EarHorn was a hotel room and a name-brand baby monitor that did not want to be in one. That is a whole post of its own and I will write it. The short version is that setting it up somewhere new took a small Wi-Fi ritual, and that when it did work, the audio went to a server belonging to a company I had not met, to be kept for a length of time I never established.

So privacy was going to be a feature. I assumed that meant a switch.

It does not. It is a handful of trades, and the awkward thing is that they are real trades. Every one of them costs you something you would also like to have.

The settings screen I actually built first

Four settings decide how two phones find each other. Whether the nursery announces itself on the network. Whether a phone publishes the address where it can be reached. Whether the app goes looking for the direct phone-to-phone radio. Whether iCloud is used at all.

All four were on the screen, individually, correctly labelled.

Nobody has ever opened a baby monitor’s settings wanting to choose a Bonjour policy, a publication mode, a direct-search tier and a CloudKit switch. People arrive wanting one of about five things:

• “It should just work.”
• “Not through Apple, please.”
• “These two phones are never on the same Wi-Fi.”
• “I want to minimize what I share.”
• “I am somewhere strange and it needs to work tonight.”

I wanted to let you have that choice. But I wasn’t doing that. I had built a screen that required you to already be me.

So the Connection pane now opens with six named combinations, and the four pickers sit underneath, greyed out, until you choose Custom. Nothing was removed. It just stopped being your job to add them up.

Automatic is the default, and it is the only one that changes its mind. The nursery goes quiet on the network when every paired parent can already reach it through iCloud, and announces itself the moment one cannot. What it costs you is predictability: it leans towards announcing whenever anything about iCloud is not ready, because the alternative is a nursery that is silent to a parent who has no other way back. A babysitter does not count towards the quiet, which is deliberate, or one evening of guest access would leave a nursery announcing itself forever.

Full connectability is Automatic with the mind made up. It announces itself always, whoever can reach it. Both phones publish an address, iCloud is on so an alert can reach a parent whose app is closed, and the direct radio is off because it costs battery, and the house Wi-Fi is preferred over it because it reaches the far end of the house.

Full plus Bluetooth turns the direct radio back on for households where the Wi-Fi is not doing its job. The screen names the battery cost.

No working LAN is the hotel and the guest flat: the network is there but it will not let two devices see each other, so the app searches for the direct link until it reconnects. Or maybe your power is out and there is no wifi. Maybe you’re in 1970 and routers don’t exist. I don’t like this mode, but in a pinch it is there.

More privacy takes the nursery off the air entirely. It announces itself only while a pairing code is showing (and not for QR codes, just the backup version), and is silent the rest of the time. What it costs is a dependency: with no announcement, an absent parent finds its way back through a record in iCloud, so this one requires iCloud and refuses if you are signed out, saying which half is missing. I would rather it refuse than pretend. The record’s contents are sealed, so Apple stores a blob it cannot read. It does see that the record exists, and when. This is what I use.

No Apple, good LAN is the other end. No iCloud, no record, nothing published. Alerts stop when EarHorn is not open, including overnight, which is a serious thing to give up and the screen says so. But if you trust your local network, and not apple, this is a strong option.

What is true whichever you pick

The nursery’s announcement, when there is one, is a rotating tag: thirty-two hex characters of nonce, a throwaway key, a port that moves. It used to be the phone’s name and its permanent identity key, which meant any device on any network the phone joined could write down that this nursery was here at this time. Now the record names nobody.

The first frame of a connection is sealed. A reconnection between two phones that already know each other states no identity at all.

The residue

If this post did not have this section it would be marketing.

A typed pairing code, for the seconds it is on screen, puts the nursery’s identity public key on the local network in the clear. It has to say something to a phone that knows nothing yet. Its identifier does not travel at all (a placeholder goes instead, true for one handshake, and the real one arrives encrypted a frame later), and the exposed key is retired when the pairing ends. A scanned QR code does not do this advertising at all. It is still a thing that happens, once, on your network.

And on a network you do not control, somebody watching traffic cannot hear anything, but can see when sound was being sent. That is a real signal about a real household. Our answer is an honest one rather than a clever one: use a tunnel you trust, and if you do not trust that, we cannot make promises.

Six sentences, not four settings. The costs are on the screen next to each.

EarHorn is a convenience tool for audio monitoring and is not a substitute for attentive supervision.