GoKawiilWhat just happened? Ring has long faced scrutiny over the privacy implications of its video doorbell and home security products, but the company will be hoping its new encryption system can alleviate some of those concerns. Called TAKE (Throw Away the Key Encryption), Ring says the standard improves privacy without restricting features. It should also limit what the company can share with law enforcement.
With TAKE, which is rolling out as the default for users worldwide, each Ring camera encrypts footage with keys that rotate every five minutes, either on-device on newer models or upon reaching the cloud on older ones.
Ring can temporarily access those keys through an isolated AWS Nitro Enclave to run enabled cloud features like Smart Alerts, Video Search, and Video Descriptions. After 24 hours, its copies are irreversibly deleted, while the owner's devices retain theirs.
If older footage needs to be processed at a user's request, the Ring app can provide the required key and send it to the company. It's deleted again when processing ends.
"With TAKE, Ring delivers the intelligent features you love and rely on, like Smart Alerts, and then throws away and deletes the encryption key. Only you retain the keys to your video," the Amazon-owned firm wrote.
Users will still be able to choose end-to-end encryption instead of TAKE for extra security, but that means anything that requires Ring to process videos in the cloud won't be available.
Amazon's white paper says TAKE is built on Messaging Layer Security (MLS), an open group-encryption standard maintained by the Internet Engineering Task Force. If users lose their device, they can recover their encryption keys on a new one by standing near a compatible Ring camera. Other recovery options include a passphrase, cloud backup, approval from an enrolled device, or a passkey.
Making TAKE the new standard might offer some relief to those concerned about what customer footage Ring can provide to law enforcement. For those who have TAKE or end-to-end encryption enabled, the company can only provide non-video information, such as basic subscriber information, in response to valid law enforcement requests such as warrants, subpoenas, and court orders.
A spokesperson told Gizmodo that Ring would also provide encrypted video files, in addition to non-video information, in response to valid legal process.
"Privacy and security are not a one-time announcement for us. They are part of how we build," the company said. "We are constantly listening to what matters most to our customers and inventing accordingly to deliver the best products and experiences possible."
... continue reading