Cam v3 storing to the cloud without a cloud account & not deleting footage

Hi folks

I’ve received my Cam v3 today and I’m concerned by a number of things…

Mainly, why is my camera uploading static shots and video footage to Wyze cloud without a cloud account/permission?

Also, why does “delete” only remove the entry from the “events” tab and leaves the unauthorized footage in your cloud/AWS?

Both are an invasion of privacy; neither the site, literature nor support make it clear that this will happen. Common sense suggests it stores to the SD card only and a subscription uploads to cloud - but in actual fact, it uploads with/without an account and simply controls access to the menu @ my.wyze.com.

Also, I thought footage was encrypted with AES? If so, where’s the key required to decrypt the footage?

I have tried to engage via Twitter, to no avail.

Thanks!

Regards,

Paul Moore
Information Security Consultant

Because you configured it to do so. And you do have an account.

It does delete it from the cloud. Even if you don’t delete it, cloud events auto-delete in 14 days.

Yes, it is encrypted. I have no idea on the behinds the scenes for that however. I could make some guesses, but they would be pure guesses.

2 Likes

You can read about wyze security practices here: Security & Trust – Wyze Labs, Inc.

I don’t know the technical details about how video is encrypted, but due to the nature of wyze services, the video is not encrypted and decrypted with a local secret on your device. For wyzes AI products, push notifications, facial recognition, and other features to work, the wyze servers need access to unencrypted video. If the video were to be encrypted on your device and only decrypted when it gets back to your device, everything in the middle would be unable to view or process the video.

Using HTTPS, the video is encrypted in transit.

Most services work using a “flag for deletion” system, rather than immediately deleting the item from the database. This is because deletions and indexing are expensive in terms of computer power, but just setting a value to “deleted” is not. Then, during off hours when more capacity is available or compute is cheaper, they can run through and actually delete all the ones that were flagged.

Additionally, if you share events with a shared user, you don’t want the shared user to be able to delete events and the main user not being able to see it. In these situations the event is just hidden for specific users.

Can you please explain?

I do not have a cloud account and I certainly haven’t configured it to store to the cloud. I actually opted not to.

All wyze cameras by default upload snapshots to the cloud.

This is a cloud based smart camera. It is assumed that users want to use cloud features.

If you want to disable this you can toggle event recording off in the cameras settings.

Thanks @iEatBeans

Can you please post a link to anywhere where it states they’re cloud cameras and store, by default, to the cloud?

Yes you do. It’s the same account that you use to use into the Wyze app on your phone. All the config for your cameras is stored in the cloud, and when a camera powers up (after being initially set up), it uses that cloud based information to configure itself.

1 Like

I think we’re talking semantics.

I appreciate login/config info is stored in the cloud, that much is obvious. I do not have an active subscription, so wouldn’t expect anything that happens on the camera to be stored elsewhere, other than the SD.

Others suggest these are “cloud” cameras, but I can’t find anything which explains it so succinctly.

Hey Paul

How would a fair notice read (and where best to put it) if you were to compose it yourself?

1 Like

SD local storage and cloud recording are seperate and independent functions. Each have their own set of settings. If you have “detect motion” enabled, what happens next depends on if you have that camera associated with a cam plus license.

If you do not want any event sent to the cloud. Disable detect motion and detect sound. If you want SD card recordings, place a SD card in the camera, enable micro SD card recording, and chose continuous or events only. Do note that some cameras have a limited SD card function based on camera type.

1 Like

Thanks @ Omgitstony

That’s my point. I only have a basic account and despite the comparison table saying “still images” only, Wyze records and stores full video in the cloud.

You may have a trial license for CamPlus. If you didn’t specifically opt out when you purchased your cameras, you probably got the free trial.

Nope, no trial. It doesn’t actually check for it (looking at the code) - it simply uploads, then tells me I don’t have access because I haven’t subscribed.

That’s really not how it’s done. That means all videos are uploaded, regardless of subscription status.

This is not true. As another poster said, you can configure your camera NOT to upload video footage. Some of my cameras are configured that way. Unfortunately for you, the default is to upload.

Where are you seeing this code? App? FW?

Mind sharing some of it?

Here is the terms of service:

Here is the Privacy Policy:

The terms of service fairly clearly say System Requirements include a constant internet connection:

More:

In the event of any service interruptions to your home’s Wi-Fi network or internet connection or to your mobile, telephone, and other network connections with respect to the Wyze App, the Products or Services may be unreliable or unavailable for the duration of such interruption.

One place that mentions cloud data agreement in the Terms of Use:

I’m sure there are lots of other places that mention things related to internet, cloud, data storage.

Still, if you want to remove cloud stuff,

  • Open your camera
  • Go to Settings
  • Go to detection settings and set everything to 0. Set a detection zone that has everything blacked out.
  • Go to Event recording and toggle off everything possible (video events and thumbnails are stored on the cloud). No recording event videos, no recording sound events.
  • Go to notifications, toggle off everything possible (notifications would include a thumbnail that gets transferred through the internet/cloud).
  • Go to Alarm settings and toggle off everything (they may otherwise upload a thumbnail image to the cloud for 14 days if the camera hears a smoke alarm)
  • Go to advanced settings and set the MicroSD card to continuous recording.

Now you’ll never get recorded events or thumbnails in the cloud and no notifications through the cloud. If you want to review anything that was recorded to the SD card, you can. You’ll connect to it with a direct peer to peer connection. Same with livestreaming. There will never be any images from your camera stored on Amazon’s servers now. The only time your cameras will use the internet are:

  1. For initial authentication with the Wyze server when you try to live stream or watch MicroSD card playback videos. After authentication approval, the connection will stay a direct peer to peer connection for as long as you stay connected (this connection will be local if you are on the same local network as the cameras, or it will use the internet if you are not on the same local network as the cameras).
  2. Occasional ping to make sure the camera is still “online”

Problem 99.9999% solved.

(ie other than the ping and the short authentication approval when you connect p2p))

4 Likes

I hear forum people. :slight_smile:

2 Likes

Sounds like me.

2 Likes

One to a @Customer :grin: