Wyze doesn’t appear to understand its responsibilities when dealing with customer security and privacy. So we’re pulling our endorsement of Wyze cameras until it chooses to do better.
After six years of reviewing a variety of Wyze security cameras at Wirecutter, we’ve made the decision to suspend our recommendation of them from all our guides.
On September 8, 2023, The Verge reported an incident in which some Wyze customers were able to access live video from other users’ cameras through the Wyze web portal. We reached out to Wyze for details, and a representative characterized the incident as small in scope, saying they “believe no more than 10 users were affected.” Other than a post to its user-to-user online forum, Wyze Communities, and communication to those it says were affected, the company has not reached out to Wyze customers, nor has it provided meaningful details about the incident.
We believe Wyze is acting irresponsibly to its customers. As such, we've made the difficult but unavoidable decision to revoke our recommendation of all Wyze cameras until the company implements meaningful changes to its security and privacy procedures.
The concern is not that Wyze had a security incident—just about every company or organization in the world will probably have to deal with some sort of security trip-up, as we have seen with big banks, the US military, Las Vegas casinos, schools, and even Chick-fil-a. The greater issue is how this company responds to a crisis. With this incident, and others in the past, it’s clear Wyze has failed to develop the sorts of robust procedures that adequately protect its customers the way they deserve.
We spoke about this incident to peers, colleagues, and experts in the field, such as Ari Lightman, professor of digital media and marketing at Carnegie Mellon University; Jen Caltrider, program director at Mozilla’s Privacy Not Included; and Wirecutter senior staff writer Max Eddy. All of them agree the central issue is that Wyze has not proactively reached out to all its customers, nor has it been adequately accountable for its failures. “When these sort of things happen, [the company has to be] very open and transparent with [the] community as to why they screwed up,” Lightman explained. “Then the company has to say, ‘Here’s exactly what we’re going to be doing to rectify any potential situation in the future.’”
If this were the first such incident, we might be less concerned. However, it comes on the heels of a March 2022 Bitdefender study (PDF), which showed that Wyze took nearly three years to fully address specific security vulnerabilities that affected all three models of Wyze Cams. The company did eventually alert customers of the issue, and it notably guided them to stop using the first-generation Wyze Cam because “continued use of the WyzeCam after February 1, 2022 carries increased risk, is discouraged by Wyze, and is entirely at your own risk”—but that was long after the serious vulnerability was first discovered and reported to Wyze, on multiple occasions, without getting a response.
The fundamental relationship between smart-home companies and their customers is founded on trust. No company can guarantee safety and security 100% of the time, but customers need to be confident that those who make and sell these products, especially security devices, are worthy of their trust. Wyze’s inability to meet these basic standards puts its customers and its devices at risk, and also casts doubt on the smart-home industry as a whole.
In order for us to consider recommending Wyze’s cameras again, the company needs to devise and implement more rigorous policies, as most of its competitors already have. They need to be proactive, accountable, and transparent. Here’s what we expect from Wyze in the event of a security incident:
Reach out to customers as soon as possible: Send an email to all customers, send push notifications in the app, put out a press release, broadcast in the Wyze Communities online forum.
Describe the issue in detail and state precisely who was affected (and who wasn’t).
Explain specifically what steps are being taken to aid affected customers and what if any actions the customer needs to take on their own.
Follow-up with customers to let them know the issue has been resolved.
For anyone who has Wyze cameras and intends to continue using them, we recommend restricting their use to noncritical spaces or activities, such as outdoor locations. If you are looking for an alternative, better camera options are available—even for smart-home users on a budget.
This isn’t the first time Wirecutter has pulled a smart-home device due to concerns over accountability. In 2019, in response to a data breach at Ring, we retracted our endorsement of all of the company’s cameras. We eventually returned to reviewing Ring gear, and in some cases recommended them to our readers, after the company made a series of significant improvements to its programs and policies.
We continue to recommend Wyze lighting, since we consider them lower-risk, lower-impact devices—a security breach of a light bulb, for instance, wouldn’t give someone a view of your living room. Should Wyze change course and adopt more substantial policies like those above, we will be happy to resume testing and considering them for recommendation.
We continue to recommend Wyze lighting, since we consider them lower-risk, lower-impact devices—a security breach of a light bulb, for instance, wouldn’t give someone a view of your living room.
Call me paranoid, but I don't want a company I don't trust plugged into my network at all.
The premise of the statement you quoted is faulty to the core. A device internal to your home network knows a lot about the design of your home network and it knows a lot about the other devices on your network, and it can be used to facilitate/relay malicious access to your other devices if it becomes compromised.
Wyze has always struggled with security problems...and I'll admit that I do have several wyze cameras...but long ago decided their security was not trustworthy and created an entirely new virtual lan to run just my IOT stuff from. That, at least, reduces the exposure for some of their security issues. I certainly would never have interior cameras built by wyze - that's too risky even with robust network security on my side of it.
Switch to Unifi. It's enterprise-grade hardware and high quality software at consumer prices. If you know networking, you can set them up without connecting them to the internet while still being able to access them outside your network. If not, you can just use their free web portal to access your cameras. It's probably easier than Wyze, and it's certainly more secure.
I don't normally like to shill brands on the internet, but for these people I make an exception.
Mine is recording cats on our porch. We are always home and it doesn't catch any audio that matters as we are rarely in the room where that window is. I would never have cameras pointed inside the house where I need privacy. Not even if I had it all hooked up to my own server the last thing I'd want is my private moments recorded lol. Freaking weird.
Our cameras point outside but the microphones are so retry sensitive and my office window is near two of them. I’m sure someone could hear my side of a phone call.
The article actually names the people they talked to. So rare to see actual journalism rather than the usual lazy "we talked to experts", which is equivalent to "we just made shit up".
If you want to self-host you NVR then anything RTSP or ONVIF. I have a combination of Ubiquiti, Reolink, Dahua, and Amcrest cameras. They sit on their own network with no Internet access and can only talk to the NVR. That's not exactly an easy setup though unless you are fairly technical but it is a private one.
Any specific reason for the mixed brands? I went 100% Unifi in my home (cameras and networking equipment) and it's amazing. Everything just works, and the apps are great. While I haven't bothered to go through the effort of setting up a VPN so that the NVR is disconnected from the internet, I know it's doable.
Ubiquiti is who I chose. Everything is self hosted, no service fees, good quality equipment and no extra frees for remote maintenance. The motion and AI detections work very well and of course all the products integrate seamlessly into their UniFi network equipment…BUT it’s more a whole network approach than just cameras.
I have had good luck with reolink cameras, which, so far, have with RTSP as a feature by default. They offer a program, which amazingly doesn't require an account be made.
I put custom RTSP firmware on all of my old Wyze cameras and then blocked them from WAN access.
Foscam is relatively cheap and I like the few PTZ cameras I have. I use RTSP and block their access to the internet. For the timestamp to stay synced I redirect the Foscam DNS requests to an NTP docker container.
Do foscams work well with Frigate? The next step in my Smart Home evolution is Cameras and I'd like to use Frigate because it integrates well with Home Assistant (and I already have the Google Coral Module).
We have a wyze camera set up in our living room, it's usually turned towards the wall but we flip it around when not home to keep an eye on our doggy.
I was home on sick leave with COVID and noticed the light turn red a couple times. I assumed it was my fiance checking on with me but I asked her and she said it wasn't her. Same thing the next day, I checked my account and it's just me and her that have access. I unplugged that shit.
They were also the easiest to use offline. I needed internet to set them up, but once they were up, as long as I didn't want to ever use the app, they didn't actually need a connection to operate.
They used to be good. They were cheap, you could flash them with custom firmware, they were very need friendly. They just gradually got worse and worse though, starting with them wanting to keep you in their app. It's always garbage profit seeking. No one is happy being good to consumers if they can make more money not doing so.
I actually had this glitch or something similar. Was staying with a friend when I got an activity alert…but it was from their camera. IIRC all it gave me was a still frame of them standing in front of it. I never bothered reporting it to Wyze. I figured it was some rare glitch because I had given my friend that camera (it was now on their account and not linked to mine).
Install the rtsp firmware, run the cams on a network without internet access, run zoneminder or other CCTV software to self host the video feeds... if you want object detection you can add it on but you'll need a processor like a coral device.
I tried RTSP on the wyze v3 cameras and it was unstable bordering on nonfunctional. Even if they worked, I think you also had to power cycle them occasionally to keep them going.