topic Re: Shared Videos are accessible without password in Arlo Pro 2

Shared Videos are accessible without password

maxim__s — Fri, 15 Mar 2019 19:53:27 GMT

The problem:

- turn on email notifications about the camera detected some movement

- emails arrive

- in the emails, there is an URL which allows you to watch the video WITHOUT ENTERING THE PASSWORD

- yes, the URL contains the long string of hex digits, but still NO PASSWORD IS REQUIRED

- the video on that webpage is called "Shared Media" or so

So, some hacker can just iterate over these hex strings and view ANY video ever saved by the Arlo camera.

Questions:

- isn't this a security problem? or is it considered to be safe due to the length of the hex string in the URL?

- if I switch email notifications off, will this kind of access to my saved videos be switched off?

- is there any possibility for me to tweak some options to switch this "Shared Media" feature off?

Re: Shared Videos are accessible without password

JamesC — Fri, 15 Mar 2019 19:53:44 GMT

maxim__s,

This email is only generated when you have email notifications turned on or you use the share option within the library. You can eliminate this by turning off email notifications.

How do I turn on/off email notifications?

JamesC

Re: Shared Videos are accessible without password

maxim__s — Sat, 16 Mar 2019 08:14:34 GMT

The problem is not in the email notifications by itself, which can be easily turned off.

The problem is that the cloud provides password-free access to the recordings, by using URLs with long hex strings.

If I turn emails off, are you absolutely sure that this access will also be terminated?

Re: Shared Videos are accessible without password

JamesC — Mon, 18 Mar 2019 16:26:13 GMT

maxim__s,

If you turn off emails, no URL is generated. This only happens when email notifications are turned on, or a clip is shared from the library manually.

JamesC