I Installed the New Firmware with Password (R8)

Turning on the camera after installing I was asked my preferred language and then I was asked to set a numerical password. A numerical keyboard pops up. Confirm the password. Upon turning on the camera again I was asked to enter the password. After entering the password I had chosen I was given the option to never have the password asked for again. Having chosen that, upon the next turn on, no password was asked for. And my settings were not lost.
Am I the only one who finds the concept of setting a password for a camera deeply worrying, even if it’s not asked for again - perhaps at some point it will be needed again? I hope you wrote it down…
Mines easy. 1 2 3 4 5 6 😂
Thats fine but 1 1 1 1 1 1 would be easier. The trouble is, each time you pick the camera up, you have to flip the little flip screen out and punch in the number. Apparently, that's true even if it has been hanging around your neck for a while and has powered down. By that time, that elusive once-in-a-lifetime shot is gone.

It looks like you have the option of telling it to ignore the PW but then what is the purpose of having it in the first place.

They should just ask "do you want to set a PW... Y/N"

I would like to hear from those who actually fired up this new FW how it actually works.
Powering down/up and sleep did not ask for the password as I instructed it.
I’ll verify again when I get home.
Just tried it again. Powered off since yesterday. Just powered up and no password request. Same for sleep mode. I even took the battery out and no PW asked for after putting it back.
That's good news -- that's how I hoped it would work. They got their network protection but didn't make the camera a PITA to use.
PS I just read the long thread on security, and I think there may be some useful answers there.
 
I have an R5 Mark ll. Can someone explain what Networking information is in my camera that I need to be concerned about protecting? As far as I’m aware, the only way into my home network is through wi-fi which means someone would have to be in range to use it. Is there something else that could be a problem? I’m really not getting the reason for this other than the EU said so.
I think the worry is that someone can use the camera as a means to access connected networks. The EU is taking the lead in ensuring that connected devices are reasonably hardened against such exploits. Canon is trying to comply with the requirement. People were concerned that they would not break the camera in the process of doing so. We should all want our stuff to be secure, but it still has to do the job it was intended to do in the way we are used to doing it.
 
Turning on the camera after installing I was asked my preferred language and then I was asked to set a numerical password. A numerical keyboard pops up. Confirm the password. Upon turning on the camera again I was asked to enter the password. After entering the password I had chosen I was given the option to never have the password asked for again. Having chosen that, upon the next turn on, no password was asked for. And my settings were not lost.
Am I the only one who finds the concept of setting a password for a camera deeply worrying, even if it’s not asked for again - perhaps at some point it will be needed again? I hope you wrote it down…
Mines easy. 1 2 3 4 5 6 😂
Thats fine but 1 1 1 1 1 1 would be easier. The trouble is, each time you pick the camera up, you have to flip the little flip screen out and punch in the number. Apparently, that's true even if it has been hanging around your neck for a while and has powered down. By that time, that elusive once-in-a-lifetime shot is gone.

It looks like you have the option of telling it to ignore the PW but then what is the purpose of having it in the first place.

They should just ask "do you want to set a PW... Y/N"

I would like to hear from those who actually fired up this new FW how it actually works.
Powering down/up and sleep did not ask for the password as I instructed it.
I’ll verify again when I get home.
Just tried it again. Powered off since yesterday. Just powered up and no password request. Same for sleep mode. I even took the battery out and no PW asked for after putting it back.
That's good news -- that's how I hoped it would work. They got their network protection but didn't make the camera a PITA to use.
Making it so you needed the password full time would have ticked a lot of people off. Even disabling still gets people unhappy.
 
I have an R5 Mark ll. Can someone explain what Networking information is in my camera that I need to be concerned about protecting? As far as I’m aware, the only way into my home network is through wi-fi which means someone would have to be in range to use it. Is there something else that could be a problem? I’m really not getting the reason for this other than the EU said so.
I think the worry is that someone can use the camera as a means to access connected networks. The EU is taking the lead in ensuring that connected devices are reasonably hardened against such exploits. Canon is trying to comply with the requirement. People were concerned that they would not break the camera in the process of doing so. We should all want our stuff to be secure, but it still has to do the job it was intended to do in the way we are used to doing it.
Thanks for the reply. My lack of understanding is about what Networking I need to be concerned about. I connect to my home WiF, my iPad & iPhone and use Canon Connect which has internet access. With the possible exception of Canon Connect, none of those other connections can be accessed without proximity to me. I’m clearly not understanding something which wouldn’t be the first time.
 
Tell me if I got this right -

This is a mandatory law, passed by the EU, to protect networks.

If I update the firmware, it's mandatory that I set a password, even if I never put a camera on the network.

If I choose to not use it, and have to do a factory reset for some reason, I have to pick another password.

So far, so good?

Question - If I skip this update, and a future update comes that I need, will this password BS be included in future updates? I'm thinking yes.
Yes. People saying they will skip this FW update will only face it in future updates. Resistance is futile.
I'm thinking the best solution for me will be to sit where I'm at with version 1.50 on the R7s. For what I do they are working fine right now.
I've always updated. I think there may be unannounced performance, etc tweaks. I don't know for sure and I can't back that up but I've never had an issue with any FW update.
 
I have an R5 Mark ll. Can someone explain what Networking information is in my camera that I need to be concerned about protecting? As far as I’m aware, the only way into my home network is through wi-fi which means someone would have to be in range to use it. Is there something else that could be a problem? I’m really not getting the reason for this other than the EU said so.
I think the worry is that someone can use the camera as a means to access connected networks. The EU is taking the lead in ensuring that connected devices are reasonably hardened against such exploits. Canon is trying to comply with the requirement. People were concerned that they would not break the camera in the process of doing so. We should all want our stuff to be secure, but it still has to do the job it was intended to do in the way we are used to doing it.
Thanks for the reply. My lack of understanding is about what Networking I need to be concerned about. I connect to my home WiF, my iPad & iPhone and use Canon Connect which has internet access. With the possible exception of Canon Connect, none of those other connections can be accessed without proximity to me. I’m clearly not understanding something which wouldn’t be the first time.
there is no way for anyone to know whether a wifi or other network credential is additionally secured by an additional vector like an attacker having a way to be in proximity to a network. A lot of people work and operate in radio dense areas with access to lot of networks (I can currently see 20+ networks visible to my laptop. if it was trivial to hack those, I am sure someone will try at some point). The mechanism is not to protect the most secure of us, but rather anyone who may be less so

Besides, no matter how safe we feel about this, I doubt any one of use would be very keen walking around the town with our wifi credentials printed on our t-shirts. Walking with a vulnerable device is more or less a similar deal. Security is good, there is no question about it. The only question is how much we want to balance it with inconvenience it might add
 
Thanks for the reply. My lack of understanding is about what Networking I need to be concerned about. I connect to my home WiF, my iPad & iPhone and use Canon Connect which has internet access. With the possible exception of Canon Connect, none of those other connections can be accessed without proximity to me. I’m clearly not understanding something which wouldn’t be the first time.
A lot of people work and operate in radio dense areas with access to lot of networks (I can currently see 20+ networks visible to my laptop.
Somehow I’m not expressing myself clearly. I understand how a laptop is vulnerable, my camera not so much. Other than Camera Connect, what internet or non-personal network connections is my camera using?
Besides, no matter how safe we feel about this, I doubt any one of use would be very keen walking around the town with our wifi credentials printed on our t-shirts.
Are my WiFi credentials visible or accessible on my camera? Even if they were, what would anyone use them for?
 
Thanks for the reply. My lack of understanding is about what Networking I need to be concerned about. I connect to my home WiF, my iPad & iPhone and use Canon Connect which has internet access. With the possible exception of Canon Connect, none of those other connections can be accessed without proximity to me. I’m clearly not understanding something which wouldn’t be the first time.
A lot of people work and operate in radio dense areas with access to lot of networks (I can currently see 20+ networks visible to my laptop.
Somehow I’m not expressing myself clearly. I understand how a laptop is vulnerable, my camera not so much. Other than Camera Connect, what internet or non-personal network connections is my camera using?
The camera can directly connect to a wifi network just like your laptop does. Camera connect is not the only option. At least on the bodies I use
Besides, no matter how safe we feel about this, I doubt any one of use would be very keen walking around the town with our wifi credentials printed on our t-shirts.
Are my WiFi credentials visible or accessible on my camera? Even if they were, what would anyone use them for?
You are asking what an hacker can exploit? That truly depends on what they are capable of. Every lock is just a proactive slow down mechanism, nothing more. For example, the camera may be set to connect to a MIM wifi network, and then passed back to you, which is probably why the network settings change log feature was added

I don't think you are thinking beyong your obvious use case. Security often goes into what is exploitable rather than possible with a specific implementation

--
PicPocket
 
Last edited:
Tell me if I got this right -

This is a mandatory law, passed by the EU, to protect networks.

If I update the firmware, it's mandatory that I set a password, even if I never put a camera on the network.

If I choose to not use it, and have to do a factory reset for some reason, I have to pick another password.

So far, so good?

Question - If I skip this update, and a future update comes that I need, will this password BS be included in future updates? I'm thinking yes.
Yes. People saying they will skip this FW update will only face it in future updates. Resistance is futile.
HA! Read my sig line. :)
I'm thinking the best solution for me will be to sit where I'm at with version 1.50 on the R7s. For what I do they are working fine right now.
I've always updated. I think there may be unannounced performance, etc tweaks. I don't know for sure and I can't back that up but I've never had an issue with any FW update.
After 3 years I can't think of anything they can improve for my shooting that can be done by FW. And I'm pretty sure they will mess up the R7ii enough to keep me where I'm at.

The only thing that might get me to pay some taco taxes would be a light weight 150-600 based on the 100-400 design, with equal or better IQ. Under 1500 grams and $2000 would be perfect. But I'm not holding my breath.
 
Somehow I’m not expressing myself clearly. I understand how a laptop is vulnerable, my camera not so much. Other than Camera Connect, what internet or non-personal network connections is my camera using?
The camera can directly connect to a wifi network just like your laptop does. Camera connect is not the only option. At least on the bodies I use
Thanks for hanging in here with me but I’ve taken this way off topic and at this point we’re just going around in circles. Yes, my camera can connect to WiFi just like my laptop but doesn’t have nearly the capabilities nor vulnerabilities that my laptop does. Someone steals my camera, somehow locates the same Starbucks WiFi I used to transfer photos to my iPad. So? I’m aware my camera can connect to things but haven’t been able to come up with one single specific example of how that could have a negative effect on me. Thanks for trying though. Time to get back to the original topic.
 
Tell me if I got this right -

This is a mandatory law, passed by the EU, to protect networks.

If I update the firmware, it's mandatory that I set a password, even if I never put a camera on the network.

If I choose to not use it, and have to do a factory reset for some reason, I have to pick another password.

So far, so good?

Question - If I skip this update, and a future update comes that I need, will this password BS be included in future updates? I'm thinking yes.
Yes. People saying they will skip this FW update will only face it in future updates. Resistance is futile.
HA! Read my sig line. :)
:-D 35 years in manufacturing and one thing I learned. You can't make 3 people happy let alone thousands.
I'm thinking the best solution for me will be to sit where I'm at with version 1.50 on the R7s. For what I do they are working fine right now.
I've always updated. I think there may be unannounced performance, etc tweaks. I don't know for sure and I can't back that up but I've never had an issue with any FW update.
After 3 years I can't think of anything they can improve for my shooting that can be done by FW. And I'm pretty sure they will mess up the R7ii enough to keep me where I'm at.

The only thing that might get me to pay some taco taxes would be a light weight 150-600 based on the 100-400 design, with equal or better IQ. Under 1500 grams and $2000 would be perfect. But I'm not holding my breath.
My 100-500 is pretty nice I'd like 100mm more.
 
Somehow I’m not expressing myself clearly. I understand how a laptop is vulnerable, my camera not so much. Other than Camera Connect, what internet or non-personal network connections is my camera using?
The camera can directly connect to a wifi network just like your laptop does. Camera connect is not the only option. At least on the bodies I use
Thanks for hanging in here with me but I’ve taken this way off topic and at this point we’re just going around in circles. Yes, my camera can connect to WiFi just like my laptop but doesn’t have nearly the capabilities nor vulnerabilities that my laptop does. Someone steals my camera, somehow locates the same Starbucks WiFi I used to transfer photos to my iPad. So? I’m aware my camera can connect to things but haven’t been able to come up with one single specific example of how that could have a negative effect on me. Thanks for trying though. Time to get back to the original topic.
This whole thing is the result of a legal ruling in the European Union. They have stated that connected devices should be password-protected. This is happening because, under certain conditions, the camera is considered a connected device, so Canon is trying to comply with that legal requirement.

These days, everything is connected to the internet: thermostats, doorbell cameras, garage door openers, your car, your TV - the list is endless. The individuals behind the law believe that there needs to be a standard of security for all of these connected devices.

That's all it is. Trying to read anything deeper into it's a fool's errand. Cameras got caught up in the mix because they now have radios in them and an RJ-45 connector on the side. Canon has to figure out how to be compliant w/o breaking the camera.
 
Somehow I’m not expressing myself clearly. I understand how a laptop is vulnerable, my camera not so much. Other than Camera Connect, what internet or non-personal network connections is my camera using?
The camera can directly connect to a wifi network just like your laptop does. Camera connect is not the only option. At least on the bodies I use
Thanks for hanging in here with me but I’ve taken this way off topic and at this point we’re just going around in circles. Yes, my camera can connect to WiFi just like my laptop but doesn’t have nearly the capabilities nor vulnerabilities that my laptop does. Someone steals my camera, somehow locates the same Starbucks WiFi I used to transfer photos to my iPad. So? I’m aware my camera can connect to things but haven’t been able to come up with one single specific example of how that could have a negative effect on me. Thanks for trying though. Time to get back to the original topic.
This whole thing is the result of a legal ruling in the European Union. They have stated that connected devices should be password-protected. This is happening because, under certain conditions, the camera is considered a connected device, so Canon is trying to comply with that legal requirement.

These days, everything is connected to the internet: thermostats, doorbell cameras, garage door openers, your car, your TV - the list is endless. The individuals behind the law believe that there needs to be a standard of security for all of these connected devices.

That's all it is. Trying to read anything deeper into it's a fool's errand. Cameras got caught up in the mix because they now have radios in them and an RJ-45 connector on the side. Canon has to figure out how to be compliant w/o breaking the camera.
Well said. There was also some issues when radio controlled flashes started hitting the market.
--
When you fail - always "Fail Forward".
 
Last edited:
Somehow I’m not expressing myself clearly. I understand how a laptop is vulnerable, my camera not so much. Other than Camera Connect, what internet or non-personal network connections is my camera using?
The camera can directly connect to a wifi network just like your laptop does. Camera connect is not the only option. At least on the bodies I use
Thanks for hanging in here with me but I’ve taken this way off topic and at this point we’re just going around in circles.
We are doing what we choose to, both of us
Yes, my camera can connect to WiFi just like my laptop but doesn’t have nearly the capabilities nor vulnerabilities that my laptop does.
We don't need as many. One that can be exploited is enough. They get exploited when people aren't looking
Someone steals my camera, somehow locates the same Starbucks WiFi I used to transfer photos to my iPad. So?
That's one use case. It doesn't have to be a stolen camera. It doesn't have to be Starbucks. What if it's workplace? What if someone taking control knows where it is? What if it's not you and me and someone else with something more to lose? So because someone doesn't have anything to lose, it's suddenly a bad idea to secure things?
I’m aware my camera can connect to things but haven’t been able to come up with one single specific example of how that could have a negative effect on me.
If we could all think of vulnerabilities before they could be identified by people who do this full time, there would be no exploits. But in real world, there are

I don't understand the argument around trying to make things secure. What we should instead be talking about is how to do it in the best, most convenient way. That way, we get somewhere, rather then argue if we should even try to
Thanks for trying though. Time to get back to the original topic.
Looking forward to that. Thanks

--
PicPocket
 
Last edited:
Turning on the camera after installing I was asked my preferred language and then I was asked to set a numerical password. A numerical keyboard pops up. Confirm the password. Upon turning on the camera again I was asked to enter the password. After entering the password I had chosen I was given the option to never have the password asked for again. Having chosen that, upon the next turn on, no password was asked for. And my settings were not lost.
Installed on R8 & R10 ... working as described. Keeping fingers crossed that it doesn't misbehave.
 
I installed new firmware on R6 mark II. Same behavior. It was annoying unitl the point I have to reset camera knowing that all my settings were lost (even though I have notes which setting to change). Then there were posts i found by googling that you can "manage password" to turn off password everytime you turn on camera.

1. I'm upset that Canon should have mentioned asking password when turn on camera in the instruction. If I have known this, I'd have not installed new firmware.

2. The only thing I want from new firmware is to use exposure simulation when using flash. While it works as it should, it's also annoying that I can't deactivate/activate this feature. This means I have no control over the way I use it. I use to assign custom function to turn ON/OFF flash to check for ambient light when using flash.

I hope Canon will change it or at least at the features to turn on/off SE when using flash. I have 2 other R6 II and WILL NOT update to this firmware.
 
I installed new firmware on R6 mark II. Same behavior. It was annoying unitl the point I have to reset camera knowing that all my settings were lost (even though I have notes which setting to change). Then there were posts i found by googling that you can "manage password" to turn off password everytime you turn on camera.

1. I'm upset that Canon should have mentioned asking password when turn on camera in the instruction. If I have known this, I'd have not installed new firmware.
It's in the release notes for the firmware and also in the updated advanced manual

As you have found you can turn the password feature off.
2. The only thing I want from new firmware is to use exposure simulation when using flash. While it works as it should, it's also annoying that I can't deactivate/activate this feature. This means I have no control over the way I use it. I use to assign custom function to turn ON/OFF flash to check for ambient light when using flash.

I hope Canon will change it or at least at the features to turn on/off SE when using flash. I have 2 other R6 II and WILL NOT update to this firmware.
 
I was transferring photos with CameraConnect and I got the message about a firmware update. I did the update to 1.6 and found out after a few failed remote exposures that I needed to enter a password. I did this, then went about continuing my shoot on the migrating Baltimore Orioles. After about 20 minutes, I realized that the remote was working but the the camera wasn't being triggered. I went outside and found that because the camera had timed out, I had to reenter the PW. A unsettling moment for me as I was thinking that I'd have to be entering a PW everytime I wanted to use the camera. It took me a few minutes to see that I could check the box and save it to never enter the PW again. Seems to be working, but I lost about 50 exposures on the orioles. Thanks Canon for including such a useful item in the update.
 
Are my WiFi credentials visible or accessible on my camera? Even if they were, what would anyone use them for?
You are asking what an hacker can exploit? That truly depends on what they are capable of. Every lock is just a proactive slow down mechanism, nothing more. For example, the camera may be set to connect to a MIM wifi network, and then passed back to you, which is probably why the network settings change log feature was added

I don't think you are thinking beyong your obvious use case. Security often goes into what is exploitable rather than possible with a specific implementation
It might be more helpful to understand this is not so much to protect user against vulnerabilities as it is to protect the manufacturer against liabilities. If the Mossad surreptitiously turns your camera into a spy device, or an enterprising Albonian finds a way to make your camera a spambot, it won't be Canon's problem, because you didn't set a difficult enough password.

When labels were required on any product sold in California to indicate the presence of carcinogenic components, it was easier just to put the label on everything, rather than sort out which product might not be suitable for use by pregnant women.

Yes, it defeats the purpose of the original mandate, but the original mandate was overly broad in the first place. When the law is virtue signaling, so is the response. ;-)
 

Keyboard shortcuts

Back
Top