In May, a security researcher named Sammy Azdoufal published research on a company called Meari. You have probably never heard of it, but it makes the hardware and runs the cloud for more than 300 brands of security cameras and baby monitors sold on Amazon and elsewhere. According to the research, anyone who opened a free account in their app could follow other people's camera notifications in real time. The snapshots cameras take when they detect motion were stored at open links, with no password and no expiry. The number reported was more than a million devices.
Even people who had changed their passwords and done everything right were not protected, because the problem sat with the vendor. The images the researcher could reach included children and private moments inside homes.
The password is not the end of the story
Let us say you did everything right. You changed the default password, turned on two-step verification, and the camera is on the latest update. Good. But there is a question a password does not answer: who else can see the stream?
Cameras today do not work alone. They are tied to a cloud account with the vendor, and that account lets you share the camera with others in one tap. That is where the story starts.
Permissions that pile up
You shared it with your brother while you were traveling. With the technician who installed it, so he could check it worked. With an employee who closed the shop at night. With a former partner, or a friend who stayed with you for a while.
Each share had a reason at the time. The trouble is that shares do not end on their own. The situation ends and the access stays.
A password protects the door and permissions decide who holds a key
Sessions you forgot about
Beyond sharing, there are sessions. Every device where you opened the app may still be signed in. The old phone you sold, the tablet the kids now use, the laptop at work. If one of them ends up with someone else and you never signed out, that person now has a window into your home.
Then there are the services you linked to the account, a voice assistant, a smart display, an automation app. Each one is another path to the stream, with its own settings and permissions.
Not every risk comes from outside
When we talk about breaches, we picture a hacker on the other side of the world. With cameras in particular, a lot of misuse comes from someone close who had legitimate access at some point. An employee who left on bad terms. A relationship that ended. None of that is about technology. It is access nobody removed.
That is why a regular review has nothing to do with distrusting people. It is ordinary housekeeping, like changing the locks when you move into a new place.
Your turn: open your camera app now and go to the sharing list. How many names are there? How many of them should stay?
The cloud itself
The Meari story raises a deeper question: where are your recordings stored? If the camera records to the cloud, the video sits on the vendor's servers. Who there can reach it? Are the recordings encrypted so that even the vendor cannot open them? How long are they kept, and can you delete them yourself?
Some vendors offer end-to-end encryption, which means only your own devices can open the video. If it is available, turn it on. And if the camera supports a memory card inside the device, ask yourself whether you need the cloud at all. The fewer places that hold a copy of your home, the fewer places it can leak from.
At the office and the shop
At work the stakes are higher. Cameras see employees and customers, and access should be written down. Who can watch the live stream? Who can download recordings? What happens to an employee's access the day they leave? If there is no written answer, there are probably lingering permissions nobody knows about.
A simple rule makes life easier: tie camera access to the role, not the person. When someone changes role or leaves, removing camera access goes on the same checklist that removes their email and building badge. Then it no longer depends on someone remembering.
Family and kids
At home, sharing is usually with family, and that is natural. But pay attention to the type of access. Not everyone needs to be an admin on the camera. Most apps offer view-only access, with no changing settings, deleting recordings or sharing with a third person. If your kids have the app on their phones, explain why the password never goes to friends, and why the stream is never opened in front of people the family does not know.
The same goes for anyone who helps around the house. A babysitter or a relative watching the place for a weekend may need temporary access. Give it, and set a reminder to remove it the day it ends.
When you sell the camera or move
Selling a camera or moving house is one of the riskiest moments, and almost nobody notices it. If you sell a camera that is still linked to your account, the buyer may be able to see your old recordings. If you leave it behind in your old home while it is still linked, you might keep seeing into someone else's home without meaning to.
Before you hand over any camera, remove it from your account, delete the recordings, and factory reset it. And if you move into a place that already has cameras, treat them as not yours until you reset them and link them to your own account. A camera you did not install is a camera you cannot be sure about.
A small routine every three months
Put a reminder in your calendar every three months. Open the sharing list and remove anyone who does not need to be there. Open the list of signed-in devices and sign out of anything you do not recognize. Review linked services. And if anything feels off, change the password and sign out of every session at once.
The camera is yours. Make sure the stream is yours too.
Check yourself
Take two minutes and answer
- I know everyone the camera is shared with
- I removed the technician and anyone no longer involved
- I signed out on old phones and devices
- I reviewed the services linked to the camera account
- I know where recordings are stored and for how long
- There is a recurring reminder to review access