Wyze Web View Service Advisory - 9/8/2023

You’re stretching. The effects of this mistake were published online (by 3rd parties) already before WYZE ever pushed out a notification. Again, they STILL have not.

The :raccoon: :raccoon:(s) are :cry: :cry:ing because someone saw them crossing the street and not in the crosswalk. :rofl:

1 Like

Just as a matter of clarification on the timeline here:

If by 3rd parties, you just mean other Wyze users posting about it here in the forums, in the Wyze subreddit, Wyze Discord server, or Facebook Core group, etc, then, yes, that is correct. However, that is completely normal for nearly every issue with every company. Users are almost always the ones to report something first, so this is no different, and is pretty normal.

If by 3rd parties you mean a site that publishes articles, then I am fairly certain that is not the case. I will explain why:

Firstly, multiple Wyze employees posted into several threads about this issue by as early as at least 2:50pm PT in one of the threads I was watching on the day it happened. I believe they posted earlier in some of the various threads on different platforms.

I repeatedly checked several different news aggregates for the word Wyze all day long, waiting to see when ANY news or tech site would mention the issue. Hours passed by and not a single one showed up. The first real public statement about it (other than posting in the social media threads themselves) that ever showed up was from Wyze itself by 6:42pm PT (It’s possible Facebook or the subreddit were earlier, I didn’t check their time stamps because I don’t even use Facebook).

I continued searching aggregate article engines throughout the day to let me know if anything about Wyze showed up. The first real “3rd party” source to mention it was theverge at 8.45pm PT, over 2 hours after Wyze had already posted their public announcement.

On the official Timeline, Wyze posted tentative messages about this as early as 2.50pm (maybe even earlier…I didn’t check every single thread and every single platform since I don’t use Facebook), and then made an official public announcement on all their platforms starting by at least 6:42pm. No 3rd party made a peep until at least 2 hours after that as far as I am aware (I was constantly searching looking for some).

If you or someone else has information that shows that some other news article/source was posting articles about this before 6:42pm PT, please let me know which publication it was, because I am curious why it wasn’t showing up in my aggregate searches until theVerge posted theirs.

Don’t get me wrong, if I worked for or consulted with Wyze, I would’ve suggested they say more, be a little more transparent earlier, and send an email out at least within a couple of days of the event occurring after a reasonable period of investigation and collection of facts. But I think they did a reasonable job. I personally hold them to a higher standard because they promised to “be friends with users” and so I think they should’ve said more sooner and more widely with an email, etc, but I don’t think how they did actually respond was bad:

  • They responded to the issue relatively fast…3 times as fast as the next fastest company that had a similar issue, and exponentially faster than T-Mobile, which let their caching issue go on for 2 WEEKS!!! and that includes companies that have BILLIONS of dollars at their disposal, and Wyze beat them all out in response and resolution timing.
  • They WERE indeed the first to post explanations about the issue, and within a reasonable time…again, faster than any other company that has had something similar. Their initial responses were pretty early, and then their public announcement response was at least 2 hours before anyone else…and theverge may not have even posted as soon as they did had it not been for the fact that Wyze publicly announced the issue (I say this because theverge mentioned they saw Wyze’s announcement and reached out to them for comment, which indicates that the public announcement actually worked since it was cited).
  • They told us enough info early on that basically explained everything. We knew it was a caching issue, and that 10 people were affected, which explanation basically explained everything from that point. We then knew that someone had accidentally changed the setting to global cache instead of individual cache. Several companies have made that mistake over the years. They told us it only affected people logged into the webview between certain time frames, and not anyone using the app or not logged into webview. We also knew that they were contacting everyone affected, and if you weren’t contacted, you weren’t affected. They also told us they implemented new safeguards and were still investigating and would release more information when they were done. That’s reasonable. Basically, we knew everything that we needed to know by that point.

The main concerns are not that they didn’t publicly announce everything properly (they did), or contact the people affected (they did), or react fast (they did), or fix it fast (they did), or implement new safeguards and procedures (they did), or tell us they’d be releasing more info when their investigation was over (they did say so), or any number of other things misunderstood. They did everything I’d expect from 99.99% of companies…better than most of them to be honest, it’s that they promised to “be friends with users” so they should live a HIGHER standard and go the extra mile. My family members (who all have tech degrees and work in tech fields) were not sad about how fast Wyze reacted or the measures they took, they just felt a little hurt that they didn’t get an email or in some way hear it from Wyze first. That’s it. The response time was good, the fixes were good, the contact of those affected was good, the action plan and new promises are all good. The only thing they would expect differently from a friend is to be treated like a friend would…go out of your way to at least reach out to them by email so they hear it from you first, not the biased click-bait news.

3 Likes

A good discussion has developed out of @Homeautomator’s challenge. :+1:

1 Like

My comment here would be that I found out about the issue almost live from my news feed with reports from a 3rd party website.
Upon searching I found the Reddit & Wyze forums thread (with pictures of some of the people’s living rooms) but at the time there were only replies from the forum mavens but no “official” response from Wyze.

Perhaps some kind of heading on forum posts which concern security topics saying “wyze is actively investigating” or an “optional” security push notification would be reassuring.

Im not a IT security expert but it’s not the first time Wyze has been all over the IT news websites for a poor response to a security issue & as a casual but committed wyze user (15 cameras) it makes you question the faith in the product you have chosen.

I appreciate Wyze is tiny company but I feel the communication on important issues like this is too slow.
Having said that, I recognise that this time, the reply is clear, honest & sincere which I appreciate.

3 Likes

For future reference, Wyze has a Service Status and Known issues page here:

The issue and many of the updates have also been posted here.

Any idea, which website(s) it was? I was proactively searching news feeds for anything mentioning Wyze throughout the day and besides Reddit, Wyze Forums, Wyze Discord server, Wyze service status page, etc, I didn’t see any third party sites coming up in the feeds/aggregators until theverge a couple of hours after Wyze had already issued their explanations about it being a caching issue and having had it resolved and brought back online now.

1 Like

The point is that we shouldn’t have to hear any of this from a third part source first be it a forum, reddit, or a respected source like The Wirecutter (it’s funny that the WYZE apologists are resorting to disparaging them instead of focusing on WYZE). I get it, a lot of people on this forum started with WYZE when it was a small company and bought into the company’s efforts to disrupt the industry so you have an emotional attachment to them and you’re on here often, know the employees by name, and what crevasse of the website to go to for security updates. This isn’t some enterprise product where the customer has their own dedicated staff monitoring security breaches and checking with the manufacturer. It’s a consumer product so most of that responsibility falls on the company.

The argument I keep reading here and in other places from WYZE Apologists is that their brother’s cousin’s father is a hotshot corporate security guy and they said that it’s standard IT practice to not notify users immediately. The reason is if they would tell us everything immediately before they have a fix then hackers would get into it. Ok, fine. What is a reasonable timeline for notification? A half hour? An hour? 2 hours? WYZE NEVER sent out a notification. Again, this website doesn’t count. People who aren’t fanboys aren’t on here all the time in case something is happening. WYZE could have easily sent out a push notification and email instead of hiding it on here.

Then there is the argument of how much to tell us. Again, you can’t excuse WYZE for not saying ANYTHING at first. They don’t have to tell us the whole story immediately, but it’d be nice to say “we detected a possible security breach, we advise you to perhaps shut down your most sensitive cameras until we figure it out” Then after a couple of hours “It turned out to be a small issue that is resolved and your information was safe, we’ll give you the full details tomorrow on this website:” Would all the IT experts on here and their cousins who are titans of the IT industry disagree with that?

I really want to be able to trust WYZE but an incident like this makes it hard. Yeah some of my cameras are pointed at a street and I don’t care that much if someone saw it, but some are indoors. Towards the end of my dad’s life, he was in rough shape so I wanted to put one of these cameras in his living room so I could check in on him but he died before I had a chance. My elderly mother so far has refused me putting a camera in her kitchen because even at 81 she knows these products aren’t safe. The best I could do was put them around the house so I can at least see her turning on and off the lights and it makes me feel more at ease knowing she’s ok in between phone calls. I’d imagine many WYZE customers have these cameras to check in on their kids and elderly family members as well so this is not trivial stuff. Trust for a product that can capture intimate moments of our lives can’t be broken.

PS. if any WYZE people are reading this, a medical alert device would be nice.

1 Like

Here’s a tag-based Service Advisory Email Alert method established a while back:

https://forums.wyze.com/tags/c/news/21/service-advisory

4 Likes

 

1 Like

Agreed. I’m not living on the website nor do I review it regularly. If information or messages need to go out, they need to be pushed through the app, webview (impacted product) or to the email of record on each acct.

:policeman: No living on the website. Move along, fella.  :wink: :grin: :laughing:


How about an in-app color-coded security/privacy nag-dot (like they do with the Shop tab when there’s a sale or new product)? Vigilant, check it. Chill, ignore it.

Maybe checking it would display a ‘best practices’ notice if a threat was still in the confidential early stages?

Wyze has a “Messages” page coded into the app. Any thoughts of using that area for…IDK :thinking:… Messages?

2 Likes

  :joy:

1 Like

I’ve tried searching for it but I don’t remember.
It was shown in the google news page on my motoG homescreen (when you scroll the homescreen all the way to the left).
I remember it was a clickbait type headline like “wyze has an ongoing security issue with their cameras”.
It might have been the Reddit thread but in my head it was one of the technews “aggregator” websites.

Searching then brought me to the wyze forum threads.

Google news was actually one of the aggregators I was actively searching constantly for anything about Wyze and never saw anything until theverge hours after Wyze’s announcement.
However, Reddit definitely had a couple of posts about this (I was following those as well), so that would make sense if it was a Reddit forum thread you saw. That would make more sense.

I appreciate the follow-up and transparency :+1:

They pulled a recommendation in 2019 i believe it was from Ring cameras.

This was asked about in the recent AMA and I thought some of you would like an update:

1 Like

Just received this on Web View, Cleared Cache but it is still there.

We have 20 Cameras Running and can only see all of them at the same time live through web view.

when using the app you can only view one camera at a time live.

We need Webview to monitor all live cameras at once.

1 Like

Is this on the old or new Web View, we did see this error on the old one at times but haven’t on the new one.

The new one is located at my.wyze.com/live

4 Likes

Old Web View. User crossposted: Wyze Web Portal - #35 by ANJ777

2 Likes