Why We're Pulling Our Recommendation of Wyze Security Cameras

https://www.nytimes.com/wirecutter/blog/wyze-security-breach/

by tysone • 3 years ago

94 112 3 years ago

drunner• 3 years ago

I mean, any security camera that does anything with the cloud should never make it onto a recommendation list in the first place.

I'm not sure if the product exists, but something that replicates a homemade setup would be amazing.

Think of a bundled camera(s) + raspberry pi + 1tb backup drive or whatever that you can only access over your own dedicated personal wireguard vpn (or tailscale, something like that), but sold as a retail bundle.

Of course, that would cut out all the SaaS/app data selling aspect so it seems unlikely to happen.

bootsmann2• 3 years ago

An IP camera that requires the customer to set-up and secure outside access themselves will not sell to end users. The market is just too small and anyone who has the skills to secure this stuff themselves doesn't have to rely on a consumer grade product.

asdff6• 3 years ago

Me, I am a potential customer! I have the skills to set this stuff up but don't have the $$$$$ to go with a commercial grade solution. Something more in the raspberry pi paradigm of price to performance is exactly what I'm looking for in this space. Just give me a cheap camera and access to io.

mistrial92• 3 years ago

your certainty is not based on reality.. "pet rocks" sold millions; BetaMax failed; great movies went unwatched, where stupid schlock got paid. Markets are not predictable entirely at all.

ynniv• 3 years ago

That's the architecture of Ubiquiti Protect: https://blog.ui.com/2019/01/09/introducing-unifi-protect/

dylan6044• 3 years ago

What is the current verdict on Ubiquiti being trustworthy after the incidents with Krebs?

ndsipa_pomu3• 3 years ago

I'm in two minds about Ubiquiti products. They're starting to become a bit more user hostile and I don't entirely trust their web based products.

However, you can set things up to run locally with self hosted servers. I've got a couple of wifi points, a switch and the old security gateway along with a couple of their cameras. I've got the Unifi device management software running in docker on a Raspberry Pi swarm and the old Unifi Video server running on x86 hardware in docker. It's probably about time I figured out how to self host the Protect server and move the cameras to that.

cortesoft• 3 years ago

The market for a product that requires the buyer to setup a VPN is not going to be very large. You seriously overestimate the average tech competence of people. It needs to be something you just plug in and it works.

PH95VuimJjqBqy• 3 years ago

cloud camera's aren't that either, most require the download of an app, signing up, configuring the camera, etc.

You could just as easily give local camera's the "printer" treatment, and most people are somehow able to successfully setup printers on their PC's.

jszymborski2• 3 years ago

I could, however, imagine you buying a "$BRAND hub" for your "$BRAND camera" and other $BRAND IoT that ostensibly set-ups a tailscale kinda thing you can access via the $BRAND App, all while not touching the cloud.

It's ostensibly the same UX as the current cloud set-up, only without the operational costs of running a cloud service.

asdff6• 3 years ago

Raspberry Pis have been sold out forever. There are plenty of competent people buying hardware with the training wheels removed.

eherot• 3 years ago

A) If customers can't manage select a properly secure cloud camera system, what makes you think they're going to do a good job picking a VPN vendor and setting up their product? But perhaps more importantly..

B) What about the apparently huge majority of us that prefer these devices precisely because the video is not stored on-site?

SkyPuncher• 3 years ago

I'm fully capable of all of the technical stuff and have done it before.

It's just a complete pain in the ass. I have a collection of "cool, but painful to maintain" devices.

Freedom2• 3 years ago

I disagree. I submit that you rather underestimate the tech competence of people - humankind have done far more with less resources due to ingenuity.

GauntletWizard• 3 years ago

I consider offsite storage a must-have feature for surveillance equipment, because one of the prime threats is that the thieves carry off the surveillance equipment itself. With modern WiFi cameras without mounting wires and cheap plastic mounting points, that's real easy, and if you had a physical server to store the recordings it would be a target as well; the history of surveillance systems is littered with examples of "The thieves stole the tapes, too".

Finding someone trustworthy enough to store your offsite footage, though, is a real problem. If only there were some sort of union of peoples capable of causing consequences for companies that act as poor stewards of data.

mptest• 3 years ago

If only there were some sort of union of peoples capable of causing consequences for companies that act as poor stewards of data.

Would be a great idea! Your wish is granted! Only one catch. The only consequence they can actually level is an insignificant fine ~ 1% of the profit they've made violating the law. Oh, plus a pinky pwomise to not do it again after a finger wag, or they'll get real angry, and the fine will be UP TO a whopping FOUR percent of profits!!!

Seriously though, re offsite storage, one could encrypt all data locally and then offsite anywhere, right? Could be google drive for all you care.

sbarre• 3 years ago

Most thieves are smash-and-grab, and not smart or motivated enough to go seek out your NAS to take with them. Danny Ocean is not breaking into your house.

Besides, if the thieves were savvy enough to find and take your surveillance gear with them, they'd be unlikely to expose anything meaningful (like their faces) on your video feeds anyways, right?

dangus• 3 years ago

What about cloud services that offer end to end encryption?

It seems like HomeKit Secure Video has pretty good security design: https://support.apple.com/guide/icloud/icloud-homekit-secure...

pj_mukh• 3 years ago

Noob question: Is it possible to stream video to a device outside your WiFi without needing a third party server in the middle? How does one do that?

ssklash• 3 years ago

A VPN tunnel into your home network is one way, or a VPS you control that has a similar connection into your home network is another.

rolph2• 3 years ago

yes its possible, but a few things generate friction, major one is ISP based filtering.

often you have to use port forwrding to connect, on ports not recognized for protocols your ISP filters out.

asdff6• 3 years ago

You can own the server yourself. Ask a buddy if you can plug in a box in their garage, now you have an off site solution.

callalex2• 3 years ago

There are two ways to accomplish this: poke a hole in your home firewall and expose the camera feed to the entire open internet, then attempt to add some kind of authentication system. This is very very hard to get right, don’t do it. The other option is to tunnel your internet connection on the remote device back into your home network so it looks to your remote device like it’s still at home. That’s called a VPN.

weeblewobble• 3 years ago

What kind of device? They make IP cams that push their stream to a preconfigured remote endpoint (with TLS). It would have to be a server on the public internet though, your phone probably wouldn’t work

mikecoles2• 3 years ago

Frigate, Coral TPU, and Tailscale/Headscale form a reasonable local solution for those who want to explore setting up their own system.

NTFY and Node-Red, with a dash of MQTT, can be bolted on for remote alerting.

gh02t• 3 years ago

Lots of vendors sell something like that you just need to look for an NVR. Ubiquiti, Synology, Reolink, Amcrest etc all sell products like this to varying extents, but other companies have realized you can make better money selling outrageous cloud subscriptions for subsidized hardware.

briffle• 3 years ago

Imagine the customer support costs of trying too help users troubleshoot VPN connection issues to their phones when they don't get their alerts.

And the huge mess of bad publicity, when someone breaks into a home, and as part of the theft, steals the device that has all the video of their crime.

robertlagrant• 3 years ago

It would be nice to just have a data service you sign up to personally that basically just gives you an AWS bucket, and products such as this just takes a key and URL to upload/download with.

wombat-man3• 3 years ago

Yeah I would love something I update occasionally and just hook up to my aws account. probably a small market though.

callalex2• 3 years ago

What a strange take. You are saying that we probably shouldn’t use the internet at all, because there is potential for something to go wrong. You probably shouldn’t live in a house either, because someone might break in. We should probably stop using bicycles or even walking because you might fall and hit your head…

Spivak• 3 years ago

I think the take is far far narrower than that. Although there is no practical/technological problem of hosting your security cam videos on 3rd party servers there is a legal problem which is once you do that data is no longer legally yours and can be silently used without your permission.

I think the minimum requirement for a legally secure cloud hosted camera is E2EE and the camera can't upload unencrypted video at all without the decryption key from the owner.

wombat-man3• 3 years ago

Well I mostly use my security camera to watch my cat stretch. For this, I'm pretty happy with nest cams.

ndsipa_pomu3• 3 years ago

Well, look who's just made themselves a major target for hackers

adamredwoods• 3 years ago

I'm confused. Wyze cameras offer cloud-free operation, storing to an SD card, is the vulnerability still there even without cloud hookup?

nunez• 3 years ago

I mean, you’re not wrong, but the family of five that just moved into $SUBURB and demands max safety for some reason is definitely not gonna do all of that and will just buy Ring or Arlo.

VHRanger• 3 years ago

IoT provider has shitty security, more at 11

ChrisMarshallNY2• 3 years ago

The fundamental relationship between smart-home companies and their customers is founded on trust.

Sadly, very few companies are trustworthy.

Not all of them are evil; wanting to get into their users' data; many are just cheap and lazy. They don't want to spend money on the types of employees and process that will result in trustworthy kit.

It's actually not hard to understand (less easy to forgive). The device market is crazy cutthroat. Margins are razor-thin, support costs can be high, and competition (especially with nation-state-funded competitors) is savage.

But I don't know how many times I have had one of my friends proudly whip out their smartphone, showing me live video of their kids playing at home, not realizing that their ultra-secure password ("fuckyouhacker") is no impediment to lots of others, getting the same feed.

mistrial92• 3 years ago

sure, but you skipped a beat there .. you setup the context of device companies (agree btw), then skip right to a particular instance of security video use with a giant emotional content. But that usecase is "keep me safe from random unsafe other humans" .. when talking about the intentions and actions of companies you, the customer, are trying to use to keep you safe, you miss the part about trivial betrayal of trust as a company. The betrayal of trust by the company you partner with, due to low-cost, convenience and attractive tech, is what a third of YNews headlines are about today.

Random predatory individuals are bad, so are zombie apocolypse denizens.. but the subject of lawful-in-name-only betrayal, in very large commercial markets, seems much more to the point today, here.

ChrisMarshallNY2• 3 years ago

The betrayal of trust by the company you partner with, due to low-cost, convenience and attractive tech, is what a third of YNews headlines are about today.

Good point.

m4632• 3 years ago

Not all of them are evil; wanting to get into their users' data;

never underestimate the power of a post-sales revenue stream.

(a business model which may take place in a software update after your purchase)

rolph2• 3 years ago

>On September 8, 2023, The Verge reported an incident in which some Wyze customers were able to access live video from other users’ cameras through the Wyze web portal.<<

an unintentional, adult, video shareing platform, sounds like something a sector of society would consider a feature.

nickthegreek• 3 years ago

Anyone have a recommendation for the an affordable security cameras that would works without a cloud? I want to replace a collection of Blink cameras. Looking for doorbell cam, indoor and outdoor. Home Automation integration a plus.

etchalon• 3 years ago

Ubiquiti is the best in the market in terms of breadth and capabilities.

bilal4hmed• 3 years ago

A key thing with ubiquiti is that you need all ubiquiti hardware for the cameras. It's an expensive affair

arwineap2• 3 years ago

If you are looking for interpretability look for onvif compatible cameras which will be usable by everything

I use standard cameras so I can write my own software. It's been a fun project but it's still pretty rough around the edges

windows_sucks• 3 years ago

I've really enjoyed using Reolink + Blue Iris.

lfmunoz4• 3 years ago

amcrest is the best I found. 100 dollars, HD, power over ethernet. built-in http interface to grab videos / stream video. So you I just plugin ethernet cable camera gets an IP, and you can configure it to push videos at some interval to any server, or connect to stream for a live stream.

nedrylandJP• 3 years ago

Aren't Amcrests just rebadged Dahuas with all the baggage?

https://en.wikipedia.org/wiki/Dahua_Technology#Cybersecurity...

bri3d• 3 years ago

Ubiquiti, for some definition of affordable, if you want something that works out of the box.

Cheap IP CCTV cameras like Reolink, Loryta, or Amcrest, isolated in their own physical LAN (they're full of security vulnerabilities, but you can keep them isolated and not care), and combined with Frigate + HomeAssistant is pretty good too if you want to nerd out on a solution. I personally hate needing out on home computing stuff but this is the one place I chose to invest because off the shelf cloud solutions are _so bad_.

joshstrange5• 3 years ago

Reolink + Reolink NVR. Completely locally, you don't have to touch the cloud. I can access it from anywhere (after punching holes in my router for specific ports or just VPN). I ran ZoneMinder with IPCams for years before just getting the Reolink NVR (I already had mostly Reolink Cameras) and I'm still kicking myself for not doing it sooner. I have spent a grand total of zero minutes of maintenance on this NVR, I spent untold hours babysitting ZoneMinder. Also the NVR has RTSP (or is it RTMP?) feeds I can pull into HomeAssistant and use for display/processing.

So many times I'd go to pull up a feed in ZoneMinder and realize the system was down, locked up, having some other odd issue. With my Reolink NVR "It just works", it was worth every penny and it wasn't even that expensive.

vorpalhex5• 3 years ago

Reolink has hardcoded backdoor creds.

https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-...

mikecoles2• 3 years ago

Amcrest cameras feeding into Frigate.

jcalvinowens• 3 years ago

I use raspberry pi zeros and the little "arducam" CSI boards. It's incredibly cheap and works great, you can make them talk to whatever you like.

Zaheer• 3 years ago

Anker (Eufy) has some now. I haven't used them but if anyone has would love to hear about their experience here. https://us.eufy.com/collections/security

t3rabytes• 3 years ago

https://www.theverge.com/23573362/anker-eufy-security-camera... Maybe avoid Eufy...

jessehattabaugh2• 3 years ago

I've owned a few EufyCams and a couple doorbell cams. They work pretty well; the motion sensing is a little too sensitive for an urban area, but they'd be perfect for suburban/rural areas. They can detect people, cars, and animals. The newest base station can be upgraded with a SATA HDD/SSD.

There was a security kerfuffle last year because motion notifications sent to your phone contained video previews which were then stored insecurely. They fixed that, and it's a feature you can disable. It's not nearly as bad as what has happened to Nest/Wyze cams where attackers can gain access to live video and even talk through the speakers.

izacus2• 3 years ago

Reolink and Ubiquiti have good options that don't need the cloud.

throwing_away• 3 years ago

Unfortunately Ubiquiti now requires you to buy into their proprietary NVR :/

intrasight• 3 years ago

Reolink is great. I'm about to add their PoE Video Doorbell. I already have two of their cameras connected to my Synology.

modzu• 3 years ago

a newspaper is dictating a specific security incident response plan for a company to follow? why not. oh, and please pay for the affiliate links

LTL_FTC• 3 years ago

Synology’s new cameras seem pretty solid and they’re NDAA & TAA compliant.

m4632• 3 years ago

that's interesting. I wonder if this is just excluding countries or has some technical requirements as well.

NDAA - National Defense Authorization Act

TAA - Trade Agreements Act

shanusmagnus2• 3 years ago

I hate Wyze so bad. They sell this really lovely and cheap IP-enabled camera, perfect for figuring out which cat was pissing in the basement. But to activate it requires your phone number, and then they spam you, forever after, with text messages from different numbers advertising their shit. Hate hate hate.

carom2• 3 years ago

I have 6 of these and can't recall ever being texted. Just send STOP or update your preferences.

bastardoperator4• 3 years ago

Same...

shanusmagnus2• 3 years ago

I have sent so many permutations of that, but I'll try against next time.

bastardoperator4• 3 years ago

I have a bunch of wyze gear, given the price I never assumed they were meant to replace a security system. What I have been doing with these cheap little cameras is getting me closer to nature.

We have a bunch of these outside and we've been watching the cats, possums, raccoons, and even turkeys frolic as they cross through our property. We even set up a little victorian style dog hours with solar panels in the backyard and the wild animals have been using it to rest. We have a ton of video of these little animals just relaxing and stretching out in the dog house too. The family loves it, every morning we get to see what the critters were up to.

Before that we were doing hydroponics and we had cameras on the fruits, the instruments for things like ph, ec, and a camera in the reservoir so we could monitor water levels.

I don't use them to watch my home, but they have been pretty solid in terms of watching other things that aren't security related or sensitive.

asdff6• 3 years ago

I did use my wyze cams like that for a while (surveilling the garden pests mainly) but then wyze cut out that functionality. It used to record a little video clip when it detected motion, now wyze wants $5 a month for that.

caned• 3 years ago

You can still achieve this by saving video (configured either to be continuous or triggered by motion) to a micro SD card.

carom2• 3 years ago

Wyze is honestly great. These cameras are a fraction of the price of everyone else. Their cloud service is a couple dollars a month per camera.

I have 2 looking out my windows at the front door and car. I move those to watch the dog when she stays home. I have one over my pool table to record shots. I've used them in the past to watch stray cats outside.

I am least happy with their outdoor cam since it doesn't do continuous recording and it requires a separate hub. I recommend the plugged in ones to everyone though.

Springtime• 3 years ago

They mention a 2023 report about unintentional access of others' cameras but this dates back to 2019 (I know this since I saved a video about it from an owner who demonstrated it, which is no longer on Youtube afaict). The video showed that while the official app couldn't display the feed if they asked Amazon Alexa to, it would.

asdff6• 3 years ago

Even the cameras like REOlink 2e are $75. This seems absurd to me. A wifi camera can't be more than what, $5 of hardware? Who is selling the cheapest, most bare bones, raw, wifi camera? Does it even exist or is every single one packaged with crapware software or sexed up by some company to over $75? Do I order direct from China for these?

erikcw• 3 years ago

I'd love something like dd-wrt but for these cloud cameras. I have some Arlo cameras that I'd love to re-flash and run without the cloud service.

flxfxp• 3 years ago

For anyone looking to shut these from internet access, install this custom firmware hack and use a local NVR: https://github.com/gtxaspec/wz_mini_hacks

Why We're Pulling Our Recommendation of Wyze Security Cameras

Related Stories