Cold TAKE: Amazon's New Encryption Method Still Doesn't Deliver Real Privacy
Amazon recently debuted a new feature for its Ring cameras that the company is calling Throw Away the Key Encryption (TAKE). The idea is to cut back on the amount of video content available to the company, and thus potentially available to law enforcement. But while it might technically add a speed bump to accessing full video content, it doesn’t deliver nearly the level of privacy we should be…
Amazon has launched a new feature called Throw Away the Key Encryption (TAKE) for its Ring cameras. The aim is to reduce the amount of video content accessible to the company and possibly to law enforcement. However, TAKE does not provide the level of privacy that users might expect from video doorbells and other security cameras. The new system involves a different method of managing encryption keys, with the user's device holding the key, and the company temporarily holding keys in its cloud infrastructure.
Ring's servers temporarily receive the keys to enable various features like video descriptions, smart alerts, and video search, before deleting the key after 24 hours. While this is an improvement over the current situation, it has some significant flaws. During the 24-hour window, Ring has access to unencrypted video from the cloud, which could potentially allow law enforcement to compel access to footage.
TAKE still allows Ring to access decrypted content, and the company does not make any assurances about third-party audits. For true privacy, end-to-end encryption would be required, which Ring already offers, and turning that on by default would provide the best protection for users.
Written by urgent.news from EFF Deeplinks's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
