Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Encryption Privacy

Amazon Rolls Out Encryption For Ring Doorbells (zdnet.com) 53

Posted by BeauHD from the finally-delivering dept.
Starting today in the U.S. (and other countries in the not too distant future), you'll be able to encrypt the video footage captured via your Ring devices. ZDNet reports: This is done with Amazon's Video End-to-End Encryption (E2EE). If you decide to install this optional privacy feature, you'll need to install a new version of the Ring application on your smartphone. Once installed, it uses a Public Key Infrastructure (PKI) security system based on an RSA 2048-bit asymmetric account signing key pair. In English, the foundation is pretty darn secure.

Earlier, Ring already encrypted videos when they are uploaded to the cloud (in transit) and stored on Ring's servers (at rest). Law enforcement doesn't have automatic access to customer devices or videos. You choose whether or not to share footage with law enforcement. With E2EE, customer videos are further secured with an additional lock, which can only be unlocked by a key that is stored on the customer's enrolled mobile device, designed so that only the customer can decrypt and view recordings on their enrolled device. In addition, you'll need to opt into using E2EE. It doesn't turn on automatically with the software update. You'll also need to set a passphrase, which you must remember. AWS doesn't keep a copy. If you lose it, you're out of luck. [Just know that if you use E2EE, various features will be missing, such as sharing your videos, being able to view encrypted videos on Ring.com, the Windows desktop app, the Mac desktop app, or the Rapid Ring app, and the Event Timeline. E2EE also won't work with many Ring devices.] ZDNet notes that while police can still ask for or demand your video and audio content, they won't be able to decrypt your E2EE end-to-end encrypted video "because the private keys required to decrypt the videos are only stored on customer's enrolled mobile devices."
This discussion has been archived. No new comments can be posted.

Amazon Rolls Out Encryption For Ring Doorbells More

Amazon Rolls Out Encryption For Ring Doorbells

Comments Filter:
  • Watch out, this could end up meaning your phone gets confiscated as evidence if police do subpoena you for footage.

  • This could have been a massively useful tool for rescue services.

    Privacy isn't a concern for me when I'd willingly and openly share information, and I'd certainly be doing that if I could fucking trust the police.
    Policing is getting way too complicated and nuanced to just keep going with the armed goon approach.

    • As long as your cameras are only pointing at your property, I have no problem with that, but I am not really interested in you sharing my privacy when I walk past your property.

      • While I value privacy as much as the next person (actually, odds are I value much more than the next person), you can have no expectation of privacy when you're out in public.

        • Actually, you can. In my country, I have the right to not be randomly recorded, even in public.

          You cannot reasonably expect to not be seen when you're in public. But you can reasonably expect to not be monitored and recorded with every step you take.

          • I would have thought you were in the U.S. based on your sig but I guess not. In the U.S., the rule is generally, in public, if you can see it you can photograph it. Here's an article written by a J.D.:
            https://legalbeagle.com/860863... [legalbeagle.com]

            Taking Photos in Public
            If you stand in a public place, you can usually take a photo of anything you can see. That means in a public park, on a public beach, on a city street or in an outdoor spectacle, like a marathon, you can shoot photos to your heart's content. Take snaps of trees and sidewalks, yes, but go ahead and snap shots of people, too. Be a little careful however if you are using a telephoto lens. Just because your feet are on public land doesn't mean that you can shoot into private property.
            Honoring Expectations of Privacy
            If a person has a reasonable expectation of privacy in a location, even if it's public, you cannot take photos there. This includes public bathrooms and sports club locker rooms. It certainly includes private homes, including backyards and pool patios.

            So if you're on a public sidewalk or street, you can be photographed without your consent. You could not, however be photographed in your home from the sidewalk or street.

            In the UK there are a reported 4.2M surveillance cameras, or one for every 14 people. In principle th

          • Re: (Score:2)

            by Bengie ( 1121981 )
            US tends to use "reasonable expectation" and "incidental recording" in a public location generally doesn't fall within that, otherwise people would not be allowed to take pictures or recording in public if anyone was around.

            • Our law here generally states that yes, you cannot. The only exception is when you can credibly claim that the person is not the intended focus of the picture. If you take a picture of a cathedral, you will invariably have some people in the picture. That's permissive.

              Trying to pull that off with a nondescript wall where your target "just happens" to be in front of will probably not fly.

  • Remember boys and girls (Score:5, Insightful)

    by rtkluttz ( 244325 ) on Tuesday July 13, 2021 @07:58PM (#61579909) Homepage

    If you don't control the encryption algorithms and method with code you can view, it's not really encrypted.

    • Also:

      Once installed, it uses a Public Key Infrastructure (PKI) security system based on an RSA 2048-bit asymmetric account signing key pair. In English, the foundation is pretty darn secure.

      Translated from marketing English, they're throwing buzzwords and big numbers around to make it look like they're pretty damn secure. The devil is in the details though, and I pretty much guarantee an encryption bypass either within a couple of weeks when people get time to look at it or when the first conference paper on it is published.

      • Also:

        Once installed, it uses a Public Key Infrastructure (PKI) security system based on an RSA 2048-bit asymmetric account signing key pair. In English, the foundation is pretty darn secure.

        Translated from marketing English, they're throwing buzzwords and big numbers around to make it look like they're pretty damn secure. The devil is in the details though, and I pretty much guarantee an encryption bypass either within a couple of weeks when people get time to look at it or when the first conference paper on it is published.

        RSA, really?

        I consider RSA to be a design smell in any new cryptosystem design. It's slow, has overly-large keys and using it correctly is surprisingly hard. None of these mean that RSA-based systems are necessarily weak, but there's just no reason to use RSA given the wide availability of better options, and that means that if you invite a competent cryptographer or cryptograhic security engineer to design your system, they'll basically never use RSA.

        So when you see RSA being used, it's a strong hint t

        • At the opposite end of the scale, you've got developers who know exactly what they're doing - which, however, I doubt is the case here - who'll use RSA: Blind it to deal with timing channels, verify the sig after generation to deal with faults, and you're done. The alternatives are ECDSA, a more or less unfixable mess of side-channels and fault problems - there's another IACR Transactions paper in the pipeline that says, yet again, "here's a new attack, all previous defences are rendered useless, time to r

          • All of my professional academic cryptographer friends disagree with you.

            • academic cryptographer

              In other words people whose target platform for the crypto is a whiteboard. This is why you need to get practitioners involved in the design process, otherwise you end up with mathematically elegant solutions that no-one can get ever working reliably in practice because they've abstracted away all the real-world issues.

    • Re: (Score:2)

      by slazzy ( 864185 )
      Yup, the encryption level doesn't matter if it's backdoored.
  • that the NSA has the technological and economic power to crack RSA 2048 bit key asymmetric encryption?

    • You think the NSA is sharing that tech with local PDs chasing down Amazon porch pirates? And, all those PDs keep their mouths shut. And, no one will ever discover they obtained and cracked "encrypted" ring videos?

      • I doubt that the NSA would tell anyone they have this tech (if they do). Yes, this PK encryption will probably protect ones privacy from local police forces.

  • "Amazon Trolls Out-Encrypt Ring Doorbells"

  • Sounds like overkill (Score:3)

    by Ronin Developer ( 67677 ) on Tuesday July 13, 2021 @08:11PM (#61579941)

    You donâ(TM)t need RSA to encrypt your video stream nor would you want to - itâ(TM)s too slow. Itâ(TM)s not a stream cipher.

    No, you use a stream cipher for real-time data. And, if you need to store it as a file, you can use a stronger block cipher like AES and convert it on the fly. However, that would entail sharing a key with the server. So, write the encrypted stream and be done with it. You can store the associated key for the file using RSA - still overkill.

    RSA can be used to exchange the keys between the ring device and the mobile device. However, other algorithms are better for this purpose. And, why use RSA rather than Elliptic Curve when EC offers the same level of security with smaller keys. And, EC is generally faster.

    Sounds more like they just wanted to âoeWowâ people by sayingâ¦âlook at my key size, babyâ.

  • My doorbell can't be hacked remotely. (Score:3)

    by Fly Swatter ( 30498 ) on Tuesday July 13, 2021 @08:36PM (#61580011) Homepage
    You must a) be physically near it, and b) press it.

    -Oldie but goody.

    • As a bonus, if you have one made of metal you can connect it directly to AC and then it also serves as a door-to-door salesmen deterrent.

      • I advise against it. The pile of rotting corpses in front of your door is not only a salesman deterrent, it also isn't really something the HOA is looking favorably at.

        And do you know what corpse removal services cost? Besides, the people you're dealing with are among those that you want to press the doorbell themselves...

      • Must admit I spent a few seconds wondering why air conditioning is harmful for salesmen...

      • Salesmen usually enjoy air conditioning. Especially the door-to-door types.

    • My TV remote never needs batteries. I just get up and change the dial.

      Sometimes convenience is pretty cool. And there are plenty of Ring equivalents without the privacy concerns (that don't connect to any cloud.)

  • I would only hand over video to the popos if it is to investigate a serious violent crime such as rape or homicide, and that too only for a specific time or per warrant.. all other investigations can fuck off.

  • Why would I buy something that's already obsolete by design?
    No Thread/Matter, no sale!

  • "[T]he private keys required to decrypt the videos are only stored on customer's enrolled mobile devices." If you only have one phone and it is destroyed/lost/stolen, do you lose access to that data?

  • You mean to say, they were sending data in the CLEAR all this time? Wow, that's so... last century.

    • Re: (Score:1)

      by Anonymous Coward
      I know reading the article is not allowed, but that's actually covered in the summary. No, the data wasn't in the clear, it was just encrypted with keys that Amazon knew. This feature is for encrypting with keys that (supposedly) Amazon doesn't know.

      • I know reading the article is not allowed, but that's actually covered in the summary. No, the data wasn't in the clear, it was just encrypted with keys that Amazon knew. This feature is for encrypting with keys that (supposedly) Amazon doesn't know.

        Ok, understood, and yes, you're right, I didn't read the article.

        So now the question was, who thought encrypting every device with the same keys was a good idea? That's almost like leaving it at the default password.

  • ...that having encryption on the Internet of Things might be a good idea?

  • One reason the camera is there is so the video can easily be reviewed in my absence if things go south. If I didn't think intrusion was a risk I wouldn't have installed the system. Binding the feed to a unique cell phone or set of phones and a potentially irretrievable key code doesn't appeal to me - and I am not that welded to mobile devices.

  • That the key is only installed on your device, assuming it's true, only means that they can't decrypt the video if you pull the ring offline quick enough. They have a command and control link to their device and obviously they can request the device to give them the key.

    This is just marketing and damage control.

  • This idea appears to rely on you continuing to possess the same mobile device and it continuing to work, without any way for you to back up these keys. I think the disadvantage is obvious.

    Preventing wide-ranging Police fishing expeditions is an obvious advantage.

    • it won't though - it just exposes you to the well defined police data grab system via secret courts and wide ranging warrants .

  • and right after the airbag triggers.

  • ...and now it sounds absolutely awful!

  • "[T]he private keys required to decrypt the videos are only stored on customer's enrolled mobile devices."

    Step 1: Kick the door in and find the occupants.
    Step 2: Smash their phone destroying the ability to view any video evidence from step 1.
    Step 3: Profit

  • So before today Ring videos were not encrypted? Does that not seem like a major security issue?

Slashdot Top Deals

Scientists will study your brain to learn more about your distant cousin, Man.

Close