Ring is introducing a new encryption system known as TAKE (Throw Away the Key Encryption) as the default setting for all its users, the company stating that it enhances privacy without limiting any of the features and may reduce the amount of data it can provide to law enforcement.
With the TAKE setting, each Ring camera encrypts the footage using keys that change every five minutes, and Ring permanently deletes its temporary copies of those keys after 24 hours; only the device owner keeps the keys in the long term.
Although this is the case, Ring is still able to access the keys for a short time in order to operate cloud features such as Smart Alerts. Although users have the option of selecting full end-to-end encryption, this will cause the cloud features to be disabled.
How Ring's TAKE Encryption Works and Handles Key Recovery
The footage recorded by each Ring camera is encrypted using keys that are changed every five minutes, with the change taking place on the device itself on the more recent models or when the data reaches the cloud on the older ones.
Ring is able to temporarily obtain those keys by using an isolated AWS Nitro Enclave in order to operate enabled cloud features such as Smart Alerts, Video Search, and Video Descriptions. Its copies of the keys are then permanently deleted after 24 hours, although the owner's devices keep their own.
If a user requests that older footage be processed, the Ring app can give the necessary key and transmit it to the company, after which the key is deleted once the processing is completed.
The company, which is owned by Amazon, stated that with TAKE Ring provides the intelligent features that you appreciate and depend on, such as Smart Alerts, before discarding and deleting the encryption key; only you will have possession of the keys to your videos.
According to Amazon's white paper, TAKE is based on Messaging Layer Security (MLS), an open group-encryption standard that is maintained by the Internet Engineering Task Force.
Users who lose their device are able to recover their encryption keys on a new one by standing near a compatible Ring camera; other methods of recovery are a passphrase, cloud backup, approval from an enrolled device, or a passkey.
What TAKE Means for Police Requests and Ring's Privacy History
Adopting TAKE as the standard might provide some reassurance to people who are worried about the kind of footage Ring can make available to law enforcement.
When TAKE or end-to-end encryption is turned on, the company will be able to give law enforcement, in response to legitimate requests such as warrants, subpoenas, and court orders, only non-video information, for example basic subscriber details.
A spokesperson for Ring stated that the company would also supply encrypted video files, along with non-video information, when responding to a valid legal request.
Users who choose full end-to-end encryption instead of TAKE obtain greater security, but as a result lose access to any features that require Ring to process the videos in the cloud.
Ring's privacy practices have been controversial for years. In 2019, a report claimed employees around the world could access customers' recorded videos, while some US staff allegedly had access to liIn 2023 the concerns grew after Amazon reached an agreement with the FTC for a settlement amounting to $5.8 million over failures in Ring's privacy and security.
The regulator stated that a former employee had viewed thousands of videos belonging to female customers, while hackers were able to gain access to about 55,000 US accounts. Amazon denied having broken the law.ts. Amazon denied violating the law.
Ring's relationship with police has also drawn scrutiny. The company ended warrantless footage requests through its Neighbors app in 2024, only to bring police requests back through its partnership with Axon the following year. Users can decline those requests, but the reversal reignited concerns about Ring products forming part of a wider private surveillance network.
Rollout and Remaining Privacy Questions
TAKE is rolling out as the default for Ring users worldwide. TAKE does address some of the technical risks involved in accessing customer footage, but it is unclear whether this will be sufficient to win back the trust of privacy-conscious users, especially since Ring will still have to provide encrypted video files when required by a valid legal request.ng will still hand over encrypted video files in response to valid legal process.
Thank you for being a Ghacks reader. The post Ring Rolls Out "Throw Away the Key" Encryption That Deletes Its Keys After 24 Hours appeared first on gHacks.
0 Commentaires