Wirecutter: Why We’re Pulling Our Recommendation of Wyze Security Cameras

[carverofchoice]

There are probably around 40+ smart camera companies just in North America, so there are countless you could choose. Though few of them will have low-profit margins with streamlined supply chain savings, etc. And even though they will be at a higher cost, many of them will be worse quality or have lower value or functionality/features overall. I guess it depends on your preferences. I have cameras from a few other companies already, but personally, Wyze is still my primary camera company and I see no reasonable reason to change that yet.

This issue with Wyze is being exaggerated and held against them unfairly in comparison to others. For example, just a couple of weeks ago, UniFi (Ubiquiti) devices were caught broadcasting private video and images and notifications to other users’ accounts too:

UniFi devices broadcasted private video to other users’ accounts

For those who don’t know, Ubiquiti/UniFi is fairly widely considered one of the more high-end camera companies (they are worth $8.4 BILLION!!! So they are a BIG FISH). So if “you get what you pay for” had any meaning, you would expect them to be among the best and safest out there (For example, their Video Doorbell Pro is $300 -more than 3 times the cost of the Wyze Pro version…they aren’t exactly comparable, but the point is about cost/quality and security, right?)…but here we see people were even able to fully log in to other people’s Unifi accounts. They had FULL access to other people’s consoles just as if they were their own. This was WAY, WAY, WAY WORSE than Wyze’s short issue. Wyze had awesome, fast response time and resolved it close to immediately and gave continual updates as they looked into the details. Ubiquity/UniFi allowed this issue to continue uninterrupted for 9 HOURS!!! That is nearly 1800% longer than Wyze. Wyze caught and took theirs offline in like 30-40minutes and fixed it, and Wyze’s wasn’t even as severe.

So here we have an example of a HUGE nearly $9 Billion company doing something WAY, WAY WORSE than Wyze, responding 1800% SLOWER than Wyze, and taking WAY LONGER than Wyze to fix it, Not giving as good of updates as Wyze. Wyze OUTPERFORMED a $9 BILLION dollar company…and that huge company did things WAY worse than Wyze, and yet everyone jokes and blows it off as no big deal. No Wirecutter pulling their recommendation against Ubiquiti or just Unifi Security Cameras. Hardly any criticism, nobody started attacking them, very little criticism or caring and yet everything about the 2 situations shows Wyze did exponentially better, and Ubiquiti performed exponentially worse for something that was similar in so many ways. Wyze was not treated fairly by the media. Lots of people heard about the Wyze issue, and I bet most people are only just now hearing about the severe Ubiquiti security breach for the first time even though it was way worse and the response was way worse, etc.

Then there is the very similar T-Mobile security issue that T-Mobile didn’t fix for a whole TWO MONTHS…and yet, Wire Cutter didn’t pull their recommendation of T-Mobile? That is really SUS. Didn’t pull a recommendation of T-Mobile or Ubiquiti, and there were recent “glitches” by Chase Bank, First Virginia Banks, Credit Karma, Sprint, and several others listed above. In fact,

I recently read an article where Cisco had some MAJOR zero day vulnerabilities and there was no mob out for Cisco’s head on a platter.

Or wait! I have one more juicy one that is so much better than the headline gives it credit for! I will explain under the link:

Comcast says hackers stole data of close to 36 million Xfinity customers |...

This is classic, so get this one…Comcast/Xfinity was warned about a critical vulnerability in a system they use since August when Hackers started ACTIVELY exploiting the vulnerability, Citrix provided a patch for the exploit in early October, but Comcast didn’t take it seriously, so 1-2 weeks after the patch was released, Comcast still ignored the patch and didn’t install it, even though they knew Hackers knew about it and knew hackers were using it. Comcast ignored it and so Comcast got hacked. Now 35.8 million customers are affected with leaked data. (Compared to Wyze only affecting 6 people? Why is everyone so mad at Wyze and not caring about all these others who are all objectively sooooo much worse? Double-Standard Hypocrisy, I tell you.)

So Comcast had 6 weeks of warning that hackers were actively exploring a critical vulnerability and did nothing. Then a patch was released for this critical vulnerability and they ignored it for 1-2 weeks despite KNOWING Hackers are right now trying to hack it.

But people are up in arms and tempers at Wyze for reacting in just 30-40 minutes and fixing everything back to normal within a couple of hours? Really? Just saying…Wyze deserves a lot more credit for their fast reaction. How are people not mad that Comcast blew this off knowing the hackers were actively exploiting this and there was a patch ready for them?

Mainstream Media articles were even making excuses for Ubiquiti’s WORSE situation and saying things like “to their credit” and “Oh, this is as old as the internet” and brushing these things off as something people shouldn’t care too much about any of it. Shaking my head at the double standard hypocrisy. Wyze outperformed multiple Billion dollar companies in their response, etc and are not being treated fairly in comparison to all the other Billion dollar huge companies that had similar or worse issues When Wyze did so much better. Maybe the other companies paid off the media or something. Sometimes I wonder if Wyze’s competition solicits trolls to attack them to drive market share to their biggest competitors. A little corporate warfare manipulating easily influenced masses through the media with a little help of the demagoguery handbook.

So…to answer the question of “if not Wyze, what camera do we buy?” It’s really up to each person. There are TONS of alternatives, most of them more expensive, and often not actually “better” but there are options better suited to different people. For example, for some people RTSP is WAY more important than other variables like Price, so in that sense, they will find other companies to be worth the extra cost. Some people feel that PoE is most important, and there are options for them that are better for that. Who is best all depends on you. Some people feel that paying $649.98 for a Vivint Spotlight camera plus $40 per month for the subscription for that camera (if you want to be able to use the app or even access the camera remotely) makes it the best, while other people detest Vivint with a passion.

As for me, and my house, we still prefer Wyze as our main camera company. I feel Wyze responded well and reasonably to their issue. All cloud based companies will have various security issues throughout their time. What matters is how they respond. I think they could’ve done more like email everyone or something, but what they DID actually do wasn’t unreasonable either.

For what it’s worth, this is Wyze’s official response thread:

Wyze Web View Service Advisory - 9/8/2023

9/22/23 In our ongoing commitment to security we wanted to share details of a mistake we made on Friday, September 8th that affected 10 people and was immediately resolved. We’ve completed an internal investigation and would like to share details of what took place and what we’re doing to prevent it from happening again. We take security extremely seriously at Wyze and work as hard as we can to give users peace of mind and earn your trust. Here’s how we fell short of that last week and what we’…

I also asked them about this issue more recently in an AMA event and they gave another response with some details:

This was asked about in the recent AMA and I thought some of you would like an update:

@Question Asked:

Questions regarding the Caching issue on the Webview service that was in the news.

TLDR; You responded well in some ways to the recent Webview Caching Issue, but why didn’t you just email everyone about it?

First, to mention what you did well (then improvement thoughts):

• You reacted fast (WAY faster than other companies that have had a similar global caching issue). You took it offline within 30-40 minutes (other billion dollar companies took hours or in one case MONTHS from the first report before they fixed their global caching problems). So you get props on response time.
• You fixed it fast and brought it online within a few hours with some new redundancies in place. That was good too.
• Timeline: You publicly told us the problem fast and posted it on your website and many of the major social media platforms. Your first messages that I saw were posted by as early as 2:50pm PT. The main explanation was posted by 6:42pm with all the real details telling us it was a caching issue, which told us basically everything. The first 3rd party article/blog/news-site to mention anything didn’t come for at least another 2hrs at 8:45pm PT by TheVerge. (I will post in a minute how many people feel you could’ve/should’ve done some things differently on the timeline too). And then Wirecutter didn’t post anything for DAYS after you’d already announced what happened, with an explanation that more details would be forthcoming when your investigation was complete (this is all reasonable so far IMO)
• You personally contacted everyone who was directly affected (good again), and we heard from some of them that they were satisfied with your response, so it’s hard to argue with that.
• You outlined a detailed list of your investigation’s findings and what you were doing to rectify the situation, including hiring an external security firm to do further testing of all systems, etc. I won’t relist them all here, but anyone can go read them for themselves: Wyze Web View Service Advisory - 9/8/2023

So far, I think all of the above is great (the initial mistake isn’t great, of course, but the response time and final outcome are pretty reasonable --at least to ME).

I know the news media is a little offended that you didn’t do some special press-release for them to do an easy copy paste sound-bite for them to make money off of or whatever, but for many Wyze customers, the REAL concern is that many people felt a little hurt that you didn’t just email everyone so we could hear something important like this from YOU first instead of being blindsided by rage-bait journalists. We don’t expect a full disclosure of EVERY security update you make, nobody does that, they just say “security updates” in their logs or whatever and not exactly what they were, but this issue was fairly public and Wyze long ago chose to adopt a core value of “Be Friends with users” and if you are someone’s friend, you proactively reach out to them to tell them about important things going on with you rather than let them get blind-sided by biased and self-serving rage-bait and wonder why you didn’t make the extra effort to make sure they heard it from you first. Yes, you did good public responses on your website and social media accounts, but not everyone follows those daily, or at all, so it seems something like an email would’ve better ensured your “friends” didn’t get blindsided by rage-bait. How will you step up your motto of being friends with users in the future &/or clarify your communication policies for such things?

@WyzeCoFounderDave

This is a really tough question that deserves a longer answer. A question that we asked ourselves with some serious reflection after the article came out from Wired that was very critical of our response.

First of all, we feel terrible about it. I know that nothing I say will make anyone feel better about it. These things are literally the worst part about being in the IoT business.

For a quick recap, this issue happened on a web viewing platform locked behind a paywall. It had no affect on the Wyze app, so we know it was isolated to a very small number of users. We found that 10 users on that platform had their streams visible to a other customers logged on in the time before we shut down access to the platform. We are absolutely certain that this issue didn’t exist on the Wyze app. If it had, our response would have been much more serious and would have included a full email and other notifications to all customers.

I appreciate you pointing out the things we did right haha, cause it has been mostly criticism that we hear. Honestly, we did not feel like we were trying to hide anything as accused of in some of the articles. As you pointed out we were telling everybody in real time what we were discovering in the investigation and what we were doing to address it on our Service Status page and posts in our communities. We emailed the affected users. We responded right away to customers on social media that there was an issue with view.wyze.com and that we took it down. We followed up on social media, our website, and our forum with multiple updates in the following days detailing exactly what happened and how we addressed it.

There are definitely some things we could have done better and we have been paying attention to the feedback. We plan on being more transparent in the future. You are right, a friend would want to hear directly before getting hit with an article like that.

After the article, we considered a full email so we reached out to a PR agency and some security professionals to get their opinion on our response and if they recommended that we do more. They consistently said that they would have followed the same steps that we took. So I honestly don’t know. Just a really tough spot and probably would have been better to just do a full email to remove any doubt that we were trying to hide it. We’re going to do our best to make sure we don’t have another opportunity to find out.

We are very sorry for letting our users down on this one!!

In the end, everyone can decide for themselves (just be aware that as long as you have cloud-based cameras, there are always privacy risks no matter which company you choose…just use best practices like secure WiFi, maybe device isolation, 2FA, not put them in bathrooms/bedrooms or other privacy areas, etc to help reduce risks). It would just be nice if the media, including Wirecutter, weren’t transparently ridiculously double-standard hypocritical about it (My opinion).

Oh, did I mention that Wirecutter actually DOES still recommend Wyze products even after this Sep 18th article saying they won’t recommend Wyze cams anymore?

• Here they say on Nov 14th (2 months after the Sept article) that people should buy the Wyze Smart Scale because after comparing DOZENS of smart scales over 6 years, Wyze is ranked as the best and “the one to get.” That includes consistency, reliable readings, utility, connectivity, app experience, app compatibility, DATA PRIVACY (wait, weren’t they complaining about this, and now they’re saying Wyze is the best at it?).
• Here they say Wyze Lock is the best Budget Lock 2 months after this Sept article
• Here they agree that Wyze is the best Smart light bulb a month after that Sept article.
• Here they say Wyze is the best Budget smart light strip 2 months after this Sept article.
• Here they are even indirectly recommending Wyze cameras again. By posting things using Wyze cameras and saying they picked a Wyze camera and suggesting things that support Wyze cameras. They could’ve left Wyze’s name out of it if they don’t want people to buy them. They posted this a month after their Sept article.
• Here they are, just 2 days after their Sept article, talking all about Wyze cameras again

So, I wouldn’t totally say that Wirecutter REALLY believes that people shouldn’t use Wyze, but now that they’ve said it, they feel stuck holding to it for a while until they can OSTENSIBLY try to claim that Wyze has done enough to meet their demands or something. I’m sure they’ll start recommending Wyze cams officially again as soon as they feel there won’t be much backlash for their evident hastyness and seemingly double-standard hypocrisy.

(Again, all of this is my perception/opinion. I don’t work for, speak for, or represent Wyze in any official capacity. I’m just a user/customer and I make my own opinions and perceptions based on what I am reading and seeing in general…I’m just saying that actions of the media aren’t adding up when I compare how they present or react to similar or worse issues from huge Billion dollar companies that do worse.)

Also, don’t get me wrong, I call Wyze out and even provide criticism when and where I feel it is warranted. Here is one of my more recent public examples that had a big impact:

Wyze has lost it way

@WyzeMatt I hope you don’t regret soliciting feedback, and you asked not to hold back, so you’ll get it. Don’t worry, I will be respectful. Here is my huge essay response (Titles for sub-sections for TLDR; people to skip ahead): My Open Letter to Wyze, I’m a major supporter I am probably one of the biggest Wyze fanboys that has ever existed. I say this so you know this is coming from someone who loves Wyze, not a complainer/hater. To establish the truth of this claim: On…

I am just saying that this particular security issue Wirecutter attacked them about isn’t one of those things where Wyze deserves all the mistreatment they received, particularly in comparison to others whom Wyze seriously outperformed by any reasonable metric or comparison.