I am running OctoPrint 1.5.3 (OctoPi 0.17.0) on RPI 4 B+ and connected to Ender 3 V2. I have a Microsoft HD 3000 webcam connected to the PI.
I have just noticed that my webcam blue LED that indicates that the camera is recording, is always on. I have not noticed this before. It stays on all the time even if the printer is off and disconnected and I'm not logged in Octoprint and my PC is off. it stays on even if I disable the webcam in Octoprint by unchecking the "Enable webcam support" option in settings and restarting the PI !!
Even when the webcam is disabled and PI is rebooted, when I type my octoprint IP followed with /webcam/?action=stream, I can see the webcam streaming !
This is really concerning and feels like a major privacy issue. Why is my webcam always on when I am not logged in to octorpint and attempting to view it. Why is the webcam still streaming when it is supposed to be disabled ?? The stream is not even password protected !
I have recently upgraded to 1.5.3, could this be the issue ?
I would appreciate any help in fixing this security bug.
mjpg-streamer is a command line application that copies JPEG frames from one or more input plugins to multiple output plugins. It can be used to stream JPEG files over an IP-based network from a webcam to various types of viewers such as Chrome, Firefox, Cambozola, VLC, mplayer, and other software capable of receiving MJPG streams.
mjpg-streamer runs independently of Octoprint - that's why it's still running even if you disabled the stream in Octoprint.
Octoprint doesn't need mjpg-streamer - it just needs a stream url that can be forwarded when you enable the webcam function.
Feel free to choose another tool of your choice.
If you want to stop the stream you have to run sudo service webcamd stop in ssh (and sudo service webcamd start to start it again)
No. That's part of the OctoPi image for a long time.
Again you can choose another tool of your choice or secure the mjpg-streamer stream with a password as documented here
It's not a bug - it works as intended.
But I have to say - I don't get how a livestream of your printer can be a security risk.
So the Webcam is supposed to be in recording mode with LED turned on even if I am not using it through Octoprint ? Shouldn't this be more obvious to the user ?
I am really very puzzled as to why Octoprint is still using my webcam when I am not logged in and even when I disabled it ! You mentioned that this is not a bug, this is a feature, so what is the purpose of having my webcam running when I specifically chose to disable it? Why doesn't Octoprint warn the user that the stream will continue even when the user choses to disable the webcam? I think the vast majority of people are under the impression that their webcam is not recording when they uncheck the box "Enable webcam support" and this is really misleading. What is the point of keeping the streaming live when the user choses to disable the webcam support ?
I really do not understand how you do not see that a camera is broadcasting on my network unprotected without my knowledge after I have specifically disabled it, is not a security risk. I believe this is the definition of a security risk. I believe users have the right to know this and should have the option to keep it or end it. Since most webcams have microphones, I wonder if Octoprint is using the webcam's microphone at any point when the user is viewing the webcam or when the user is not. Please confirm this.
Octoprint is really a great gift to 3D printing community and everyone, including myself, are very appreciative of the hard work and dedication that goes behind making and updating it. I have seen multiple youtubers saying that you can allow Octoprint to collect data and I chose to do that as well, because everyone trusts that Octoprint is made by people with great intentions. I cannot say at the moment that this has changed and I really hope we have an update as soon as possible that addresses the below:
1- Activate the webcam only when the user is trying to access it or at least give the user the option to run the webcam in this mode rather than having the webcam on all the time.
2- When the user disables the webcam, Octoprint should do just that, stop accessing the webcam and kill the stream. Alternatively, you can allow the user to click on button that runs the command you mentioned. In all cases the users has to be clearly made aware that the streaming is still running after he/she disabled the webcam support.
3- Allow the user to setup a username/password for the webcam stream from the interface.
I would distinguish between recording and activated.
Actually, there is nothing recorded anywhere when the camera is just activated.
Recording starts when you start a print via timelapse or octolapse.
But you can recieve the camera image anywhere in your LAN.
They can. You've been told how to enable and disable the webcam server which, again, is not part of OctoPrint. OctoPi ships with it out of convenience. You are not forced to use it. You could also setup some other camera that supports mjpg streaming and not use the bundled server at all.
An always on webcam stream is not per se a security and privacy issue. The stream does not automatically broadcast anywhere, someone had to actively open it to consume it, data doesn't magically flow anywhere otherwise. If you have OctoPrint setup as recommended, strictly in a private network where you can trust anyone connected to it, there is no problem. If however you completely go against all the recommended setup and install port forwards from the public internet or other hostile networks, that's on you.
This is open source software, all of it. Claiming "users don't have control" is sensationalist when they have full root access and various even automatic enable/disable routines are well documented on the forums.
I think It would help if there is a note in the webcam settings page that makes users aware that the streaming continues even if the webcam is disabled in OctoPrint. The vast majority of people will continue to assume that OctoPrint controls the webcam and most people do not know how to run Linux commands or routines. If it possible to control this from the interface, it would be great. These are suggestions and I think other users also would appreciate these updates.
That would mean tightly tying OctoPrint to the OctoPi specific setup that - while most common - is not the only way OctoPrint can be run. So that is a no go in core OctoPrint. We could however add some system menu actions to OctoPi by default.
I agree, that's a good idea. This will be in 1.6.0:
