Protecting an email address during smart home setup means giving each device brand its own managed alias instead of the main personal address, with a unique password and two-factor authentication on every account. The address entered at setup becomes the login, the password reset route and the channel for security alerts for every device on the account. Ring and Wyze have each had incidents in which account data, including email addresses, was exposed, and Eufy uploaded face thumbnails to cloud servers without the owner having a cloud storage account. In the Ring and Wyze cases the email address was the key to cameras inside the home.
The email address at setup#
A smart home device cannot be set up without an account, and the account cannot be created without an email address. Google states that a Google Account is needed to create a Nest app account, and that Nest cameras and doorbells need an account for setup, notifications and video footage. Wyze states that a Wyze account controls Wyze devices. The address is therefore the account itself, and it stays attached to every device and every alert.
The same address is often also the login for banking, shopping, work and social accounts, so a leak at one smart home company hands attackers an address known to be real and active. A password reused across accounts turns a single leak into access to several accounts at once.
Ring credential leak, 2019#
In December 2019, login credentials for 3,672 Ring camera owners were found posted on a text storage site. The data held login emails, passwords, time zones and camera names such as "bedroom" or "front door". Bitdefender reported that BuzzFeed News verified the leak with four of the people affected. With the login email and password, an intruder could reach the home address, phone number and payment card details on the account, live footage from all cameras on the account, and 30 to 60 days of video history. Security Magazine reported the same figures.
Ring denied that its own systems had been breached and said the credentials were harvested from other breaches. Security researchers cited by BuzzFeed said the standardised format of the data suggested a company database. The origin was never settled in public. None of the affected owners had two-factor authentication enabled. A second list of around 1,562 Ring credentials was reported on the same day, according to Gizmodo.
Ring and the Federal Trade Commission, 2023#
In May 2023, the Federal Trade Commission charged Ring with compromising customer privacy by allowing any employee or contractor to access customer videos, and with failing to put basic protections in place against credential stuffing and brute force attacks. The complaint states that any employee or contractor, including hundreds of Ukraine-based contractors, could access customer videos. One employee viewed thousands of recordings belonging to female users over several months before another employee discovered the misconduct.
The FTC complaint also states that Ring experienced multiple credential stuffing attacks in 2017 and 2018 and did not add multi-factor authentication until 2019. Hackers accessed stored videos, live streams and account profiles of about 55,000 US customers between January 2019 and March 2020, and used the two-way talk feature to harass people, including children. Ring agreed to pay $5.8 million in consumer refunds and to run a data security programme for 20 years, while denying that it violated the law. TechCrunch covered the settlement and noted that Ring made two-factor authentication mandatory in February 2020 and added end-to-end encryption in 2021.
Wyze database exposure, 2019#
In December 2019, Wyze confirmed that an unsecured database had exposed user data from 4 December to 26 December. The database was a copy of production data made for measuring business metrics, and an employee removed the security protocols on 4 December by mistake. BleepingComputer reported that it held customer emails, camera nicknames, Wi-Fi network names, Wyze device information, Alexa tokens for about 24,000 users, and body metrics for 140 beta testers. Twelve Security, the firm that found the exposure, put the number of affected customers at about 2.4 million. Wyze did not confirm that number.
Wyze said the database held no passwords or financial information, forced all users to log back in and refreshed API tokens. Threatpost reported the same sequence and noted that Wyze warned customers to watch for phishing using the exposed email addresses. Digital Trends reported that a second unprotected database was found during the audit that followed.
Wyze web view incident, 2023#
In September 2023, an engineer fixing a bug on the Wyze web viewing portal selected the wrong caching setting. For about 40 minutes, up to 2,300 users who logged in could have seen cameras belonging to 10 affected users. Wyze disclosed the incident in its own forum advisory, took the portal down, notified the 10 users and hired an external security firm for penetration testing.
Eufy thumbnail uploads, 2022#
In November 2022, security researcher Paul Moore found that his Eufy Doorbell Dual was uploading thumbnail images of faces to cloud servers even though he had no Eufy cloud storage account. Gizmodo reported that the uploaded clips were not encrypted and could be played in a desktop media player. AppleInsider reported that the Eufy website could still show an uploaded image after Moore turned off the HomeBase.
Eufy replied that thumbnails were briefly hosted on AWS to send push notifications with thumbnail images, and that the app had failed to disclose this. Eufy stated that the thumbnails were encrypted on its servers and deleted automatically, while Moore demonstrated unencrypted playback of uploaded clips. In a statement quoted by Security Systems News, Eufy called the lack of communication an oversight, apologised, and said it would revise the notification wording. Eufy also said it had closed the route that allowed camera streams to be played in a third-party player without authentication. No account credentials leaked in the Eufy case. Data left the home when the owner had chosen local storage, and the thumbnails were tied to the Eufy account. MacRumors reported in January 2023 that Anker said every Eufy camera was being updated to use WebRTC, which is encrypted by default, and that it was bringing in third-party security companies to audit Eufy products.
Incident summary#
| Brand | Date | Data exposed or affected |
|---|---|---|
| Ring | December 2019 | Login emails and passwords for 3,672 owners, with camera names and time zones |
| Ring | May 2023 | About 55,000 US customers had accounts compromised, per the FTC complaint |
| Wyze | December 2019 | Customer emails, camera nicknames, Wi-Fi names and device data for about 2.4 million customers, per Twelve Security |
| Wyze | September 2023 | Up to 2,300 users could have seen cameras belonging to 10 affected users |
| Eufy | November 2022 | Face thumbnails uploaded to cloud servers without a cloud storage account |
One alias per device brand#
The response is to give each device brand its own address: one alias for Ring, one for Wyze, one for Google Nest, one for Eufy, and so on. If one brand leaks, the exposed address belongs to that brand only and cannot be used to sign in to the other brands. The alias must stay active for the life of the devices, because password resets, security alerts and firmware notices all go to it. An address that stops working locks the owner out, so the alias must be managed and persistent.
A separate alias also shows the source of spam. If phishing mail arrives on the Ring alias, the sender got that address from Ring or from a leak of Ring data, and the alias can be paused or replaced without touching any other account. That only works if the alias is used for one brand and nothing else.
An alias that stops working locks the account owner out of password resets and security alerts. The alias stays active for the life of the devices, and the recovery address on the account stays current.
Two-factor authentication and recovery#
An alias limits the damage from a leak. It does not stop someone who already has the password from signing in. Two-factor authentication stops a password alone from opening an account.
Ring supports two-step verification through a six-digit code sent by text message or generated by an authenticator app, managed in Control Centre, and Ring documents the setup. Wyze now has two-factor authentication enabled by default, with email, SMS and authenticator app codes as the available methods, according to Wyze support. The same page warns that losing access to the phone number used for two-factor authentication may mean a new account is needed. Google Nest accounts use the Google Account's own two-step verification.
Recovery details carry the same weight as the password, and the recovery email is a different address from the one being protected. A password manager holds a unique password for each brand, and the backup codes from two-factor setup are stored somewhere other than the phone. Have I Been Pwned can check whether an address has already appeared in a breach.
AliasFleet and smart home accounts#
AliasFleet provides managed email aliases that forward to a real inbox. One alias per device brand gives each smart home account its own address, and the alias can be paused or replaced if it starts receiving spam or appears in a breach. The free tier includes 10 active aliases, 1 verified destination inbox, 3 managed subdomains and 100 MB of monthly forwarding. Pro plans add unlimited aliases and custom domains. AliasFleet does not control the security of the smart home brands, and an alias does not replace two-factor authentication or a unique password on those accounts.
Account setup sequence#
The setup sequence for a new device runs in the same order for each brand. A managed alias is created for the brand before the account is opened. The account is registered with that alias and a unique password stored in a password manager. Two-factor authentication is turned on and the backup codes are stored away from the phone. The recovery email and phone number are checked and kept current. The alias stays active for the life of the devices, and the address is checked on Have I Been Pwned after setup.
