Wyze's devices have long been on our lists of the best home security cameras and best video doorbells, as they deliver a pretty good experience for a very low price. However, one area where they've generally been lacking in comparison to the competitors has been, ironically, security.
As recently as last year, the company suffered a security breach that allowed 13,000 users to see footage from other people's cameras. Three years ago, Bitdefender discovered another breach that proved unfixable for first-generation Wyze Cams.
Those screwups could hopefully be a thing of the past, as the company today announced a significant overhaul of its security procedures and protocols aimed at preventing these issues from arising ever again. Here's a rundown of what the company is doing.
Mandatory 2FA: By default, all Wyze accounts will now be required to use two-factor authentication to prevent hackers from accessing a user's account without their knowledge.
VerifiedView: Now, when you set up a Wyze camera, VerifiedView will embed your user ID (scrambled, of course) onto the camera itself. From then on, any video, photo, or livestream from that camera will contain your scrambled userID in the metadata. Before you (or anyone) can then access those recordings, VerifiedView will cross-check the userID on the video with that of your account. This should prevent others from seeing your videos, even if there's a failure like the one that occurred last year.
Stronger logins: Wyze implemented OAuth, so you can now use trusted identity providers like Google, Apple, Facebook, or Amazon to log into your account. It also has enabled reCaptcha on Login Endpoints, Mobile Trust Device Security, Device Fingerprint Blocking, and Login Abuse Detection (User/Device/Location/IP).
Behind the scenes, Wyze said it's also instituting a bug bounty program, investing more with AWS security tools (including Lacework, AWS Security Hub, AWS Inspector, AWS GuardDuty, and Amazon Q CLI), and working with NCC Group, Bitdefender, Google MASA, ioXT and ReFirm Labs to conduct penetration testing.
Outlook
As someone who likes Wyze's devices but is leery of their privacy issues, these are all welcome changes indeed. Considering companies like Ring instituted mandatory 2FA five years ago, it's surprising that it's taken Wyze so long to follow suit.
Whenever you're in the market for a security camera or video doorbell, it's important to take a good look at the company that makes the device. Otherwise, you might never know who's watching you.
More from Tom's Guide
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
