After six years of reviewing a variety of Wyze security cameras at Wirecutter, we’ve made the decision to suspend our recommendation of them from all our guides.

On September 8, 2023, The Verge reported an incident in which some Wyze customers were able to access live video from other users’ cameras through the Wyze web portal. We reached out to Wyze for details, and a representative characterized the incident as small in scope, saying they “believe no more than 10 users were affected.” Other than a post to its user-to-user online forum, Wyze Communities, and communication to those it says were affected, the company has not reached out to Wyze customers, nor has it provided meaningful details about the incident.

We believe Wyze is acting irresponsibly to its customers. As such, we’ve made the difficult but unavoidable decision to revoke our recommendation of all Wyze cameras until the company implements meaningful changes to its security and privacy procedures.

The concern is not that Wyze had a security incident—just about every company or organization in the world will probably have to deal with some sort of security trip-up, as we have seen with big banks, the US military, Las Vegas casinos, schools, and even Chick-fil-a. The greater issue is how this company responds to a crisis. With this incident, and others in the past, it’s clear Wyze has failed to develop the sorts of robust procedures that adequately protect its customers the way they deserve.

We spoke about this incident to peers, colleagues, and experts in the field, such as Ari Lightman, professor of digital media and marketing at Carnegie Mellon University; Jen Caltrider, program director at Mozilla’s Privacy Not Included; and Wirecutter senior staff writer Max Eddy. All of them agree the central issue is that Wyze has not proactively reached out to all its customers, nor has it been adequately accountable for its failures. “When these sort of things happen, [the company has to be] very open and transparent with [the] community as to why they screwed up,” Lightman explained. “Then the company has to say, ‘Here’s exactly what we’re going to be doing to rectify any potential situation in the future.’”

If this were the first such incident, we might be less concerned. However, it comes on the heels of a March 2022 Bitdefender study (PDF), which showed that Wyze took nearly three years to fully address specific security vulnerabilities that affected all three models of Wyze Cams. The company did eventually alert customers of the issue, and it notably guided them to stop using the first-generation Wyze Cam because “continued use of the WyzeCam after February 1, 2022 carries increased risk, is discouraged by Wyze, and is entirely at your own risk”—but that was long after the serious vulnerability was first discovered and reported to Wyze, on multiple occasions, without getting a response.

The fundamental relationship between smart-home companies and their customers is founded on trust. No company can guarantee safety and security 100% of the time, but customers need to be confident that those who make and sell these products, especially security devices, are worthy of their trust. Wyze’s inability to meet these basic standards puts its customers and its devices at risk, and also casts doubt on the smart-home industry as a whole.

In order for us to consider recommending Wyze’s cameras again, the company needs to devise and implement more rigorous policies, as most of its competitors already have. They need to be proactive, accountable, and transparent. Here’s what we expect from Wyze in the event of a security incident:

  • Reach out to customers as soon as possible: Send an email to all customers, send push notifications in the app, put out a press release, broadcast in the Wyze Communities online forum.
  • Describe the issue in detail and state precisely who was affected (and who wasn’t).
  • Explain specifically what steps are being taken to aid affected customers and what if any actions the customer needs to take on their own.
  • Follow-up with customers to let them know the issue has been resolved.

For anyone who has Wyze cameras and intends to continue using them, we recommend restricting their use to noncritical spaces or activities, such as outdoor locations. If you are looking for an alternative, better camera options are available—even for smart-home users on a budget.

This isn’t the first time Wirecutter has pulled a smart-home device due to concerns over accountability. In 2019, in response to a data breach at Ring, we retracted our endorsement of all of the company’s cameras. We eventually returned to reviewing Ring gear, and in some cases recommended them to our readers, after the company made a series of significant improvements to its programs and policies.

We continue to recommend Wyze lighting, since we consider them lower-risk, lower-impact devices—a security breach of a light bulb, for instance, wouldn’t give someone a view of your living room. Should Wyze change course and adopt more substantial policies like those above, we will be happy to resume testing and considering them for recommendation.

  • Reygle@lemmy.world
    link
    fedilink
    English
    arrow-up
    33
    arrow-down
    1
    ·
    1 year ago

    Yeah- your own wired cameras wired to your own ON PREMISES NVR. Anything type of wifi cameras handled by a web portal are completely un-securable and it’s not a question of if the company shuts them down, but when.

    • archomrade [he/him]
      link
      fedilink
      English
      arrow-up
      6
      ·
      edit-2
      1 year ago

      Edit* - someone mentioned Amcrest as an alternative. Not as cheap as Wyze but they have a couple $70 cameras that aren’t unreasonable, definitely giving them a try.

      It drives me absolutely crazy that there are no cheap NVR cameras in the wyze price-range. If only I could afford a Unifi camera, i’d do it in a heartbeat, but I don’t have several hundred to shell out for the camera and several hundred more for a dream machine.

      If there were $30 cameras somewhere that can only be accessed through LAN or PoE connections, I’d absolutely cream my pants over it.

      • planish@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        There kind of are: they’re the Wyze cameras, just with custom firmware. They stand up a little web server, and you never log them in to Wyze.

      • Reygle@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        edit-2
        1 year ago

        I’ve used Surevision a number of times and like their gear too, all remotely accessible from mobile/etc but at least they’re systems THAT YOU OWN and THAT YOU OPERATE. Since it’s impossible to use/test everything I can’t say they’re any better or worse than others. I always recommend against “cloud” cameras and the people who ignore my recommendation always come back saying they regret it, usually 1-2 years later, but sometimes much sooner.

        "Why is my internet speed trash after installing 15 wifi cloud cams? GEE I WONDER

        Spend the money once or spend it every two years hrmmmmm

    • jackie_jormp_jomp@lemm.ee
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      2
      ·
      1 year ago

      Great, but what kind? Is there a bundle I can buy easily? People go the cloud route because of simplicity

      • locuester@lemmy.zip
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        6
        ·
        1 year ago

        Why wouldn’t someone have the capability? Time? Money? Other?

        A synology nas device seems a minimal cost of time and money.

          • locuester@lemmy.zip
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            I’m a short term renter. I take my nas, router, and even starlink (for if needed) with me as I move house to house. Takes 10 mins to setup the network and my cameras.

          • Shaggy1050@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            You can get wireless IP cameras and put them on a separate wireless network that does not connect to the internet.

        • socsa@lemmy.ml
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          1
          ·
          1 year ago

          For me the whole point of security cameras is real time notifications and cloud infrastructure. Having videos of someone robbing my house after the fact is a distant second motivation. Also, if officer Barbrady kicks down my door and violates my rights, he’s much more likely to get my NAS than some random docker on a random AWS colo.

          • locuester@lemmy.zip
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            Well sure, you have the nas backing up to the cloud if you want. Or just setup the video stream to go to the an aws instance running nvr software.

            Notifications work any way you set it up so that’s no difference.

            Either way, still not using third party “cloud” magic.

    • RaoulDook@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      1 year ago

      Not accurate. I have a number of wifi cameras with web administration portals on each device, not on the Internet, and they are secured by my firewall. The firewall does not permit them to access or be accessed by the Internet.