topic Re: What's with the new password requirement? in EOS DSLR & Mirrorless Cameras

What's with the new password requirement?

Davoud — Sat, 02 Aug 2025 21:36:26 GMT

Is this really necessary? Is there a bypass to avoid entering a password? If not, and if you find or steal my R5 or R5 Mk II, try 999999.

Re: What's with the new password requirement?

kvbarkley — Sat, 02 Aug 2025 21:40:04 GMT

https://community.usa.canon.com/t5/Learn-With-Canon/Firmware-Security-Features/ba-p/561532

Re: What's with the new password requirement?

Davoud — Sat, 02 Aug 2025 22:21:12 GMT

Yeah. People go nuts, get overzealous.

Re: What's with the new password requirement?

kvbarkley — Sat, 02 Aug 2025 22:55:02 GMT

The buzz around here is that it is an EU requirement

Re: What's with the new password requirement?

LeeP — Sat, 02 Aug 2025 23:26:08 GMT

Yes the EU is more "proactive" or "nanny state" depending on how you see it and it has a ripple effect to elsewhere.

Porsche for example cannot build the gas-powered Macan--their cash cow--due to some cybersecurity nonsense because the "architecture" of the car won't allow it to be upgraded easily.

And while I am all for cybersecurity, a password on my camera seems antithetical to me. I understand why it's there and the reasoning behind it.

Re: What's with the new password requirement?

p4pictures — Sun, 03 Aug 2025 12:50:50 GMT

I am pretty sure this is a case of bureaucrats making rules with no consideration of how photographers use cameras

Re: What's with the new password requirement?

johnrmoyer — Sun, 03 Aug 2025 13:32:32 GMT

Radio Equipment Directive 2014/53/EU with extension according to Commission Delegated Regulation (EU) 2022/30

ETSI EN 303 645 (Cyber Security for Consumer Internet of Things: Baseline Requirements)

CEN/CENELEC EN 18031-1, EN 18031-2 and EN 18031-3:

EN 18031-1: Radio equipment with an internet connection

EN 18031-2: Radio devices that process data

EN 18031-3: Internet-enabled radio devices that process virtual money or monetary values

https://ib-lenhardt.com/kb/faq/radio-equipment-directive-red#cybersecurity-requirements

Cybersecurity & Emerging Technologies

Wireless innovation and increasing device connectivity bring new
regulatory challenges under the Radio Equipment Directive (RED). To
address risks such as unauthorized access, data breaches, and spectrum
congestion, the EU has expanded RED requirements for cybersecurity,
interoperability, and spectrum efficiency. These provisions are
especially relevant for manufacturers of IoT devices, 5G products, and
smart home technologies.

Cybersecurity Requirements (mandatory from August 2025)

From August 1, 2025, new cybersecurity requirements under Articles
3(3)(d), (e), and (f) of the RED become legally binding. These cover
software protection, secure data handling, and fraud prevention. The
following harmonized standards provide a presumption of conformity—with
restrictions:

EN 18031-1:2024 – Internet-connected radio equipment

EN 18031-2:2024 – Devices processing personal data (e.g. toys, wearables)

EN 18031-3:2024 – Devices used for virtual or financial transactions

However, these standards do not provide a presumption of conformity in the following cases:

If users can bypass or disable password requirements (clauses 6.2.5.1, 6.2.5.2)

If parental access control is not ensured in applicable equipment categories (EN 18031-2:2024, clauses 6.1.3–6.1.6)

If assessment relies solely on explanatory sections like “Rationale” or “Guidance”

In such cases, manufacturers must conduct a full conformity assessment, possibly involving a Notified Body, as specified in EU Decision (EU) 2025/138.

Preparing for RED compliance with cybersecurity requirements for IoT?
Learn more about test procedures and applicable standards—such as EN 303
645 and EN 18031—on our IoT cybersecurity certification page.

Re: What's with the new password requirement?

LeeP — Sun, 03 Aug 2025 14:28:43 GMT

Typical of lawmakers everywhere, but they believe that writing an all-encompassing law solves the problem--even if the "problem" is a false narrative--and they further believe that they (1) do not need to understand the issue and that (2) they know better anyway. I'd rather have society be under-regulated than over-regulated, but until I am the King of Everything my input isn't being sought by politicians. This requirement for cameras is patently idiotic in my estimation. I don't plan to update the software.

Re: What's with the new password requirement?

johnrmoyer — Sun, 03 Aug 2025 15:41:39 GMT

@LeeP wrote:

Typical of lawmakers everywhere, but they believe that writing an all-encompassing law solves the problem--even if the "problem" is a false narrative--and they further believe that they (1) do not need to understand the issue and that (2) they know better anyway. I'd rather have society be under-regulated than over-regulated, but until I am the King of Everything my input isn't being sought by politicians. This requirement for cameras is patently idiotic in my estimation. I don't plan to update the software.

Warning: off topic philosophy is included in my response

I have not found the firmware update to cause any problems on my EOS R5. It also has no benefit to me since I do not use the wifi built into the camera for ftp data transfers.

The problem being solved is the huge number of devices with radios that are connected to the internet without any bit of security, much less security updates. These devices are formed into botnets used to attack businesses, governments, and even hospitals. https://www.schneier.com/tag/internet-of-things/

A simplified explanation: https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/

security expert Bruce Schneier argued that the universe of IoT things will largely remain insecure and open to compromise unless and until government steps in and fixes the problem.

“When we have market failures, government is the only solution,” Schneier wrote. “The government could impose security regulations on IoT manufacturers, forcing them to make their devices secure even though their customers don’t care. They could impose liabilities on manufacturers, allowing people like Brian Krebs to sue them. Any of these would raise the cost of insecurity and give companies incentives to spend money making their devices secure.”

A regulation is needed because there is otherwise no incentive for the manufacturer to attempt to secure the device. The costs of insecurity are a burden on others and not the manufacturer. This is what economists call a negative exeternality. The basic concept is that your freedom does not allow you to impose costs on others.

Re: What's with the new password requirement?

Waddizzle — Sun, 03 Aug 2025 18:15:47 GMT

I’m blaming Tony Northrop. He’s been suggesting adding password security to cameras for years.

Re: What's with the new password requirement?

Davoud — Sun, 03 Aug 2025 20:51:17 GMT

Well, it screwed me over today. Perhaps I didn't understand the complex phrase "Don't Ask Again." I selected that option. I was outside in harsh sunlight, temperature perfect, bees and butterflies everywhere, R5 Mk II at the ready (or so I believed) with the RF 100 macro. Each time I raised the camera to my eye I saw the Enter Password demand. After telling it not to ask again. Difficult to enter even the simple PW in brilliant sunlight. Only after I came in and did an AI search did I learn that the camera has a "Manage Password" item under the yellow menu. That delay cost me some great photos of butterflies in flight. I just hope that the new setting persists. I don't like to hear insects saying "C'mon, idiot, I don't have all day."

Re: What's with the new password requirement?

Davoud — Sun, 03 Aug 2025 20:54:00 GMT

Wireless innovation and increasing device connectivity bring new
regulatory challenges...

I wonder if that should read new regulatory opportunities...

Re: What's with the new password requirement?

LeeP — Sun, 03 Aug 2025 21:34:56 GMT

We're far afield of cameras and camera solutions, and I acknowledge the tangent I helped set in motion, but nevertheless I agree with you.

Re: What's with the new password requirement?

ArizonaBill — Sun, 14 Sep 2025 16:53:11 GMT

The nine most feared words in the English language "I'm from the government and I'm here to help." . . President Ronald Reagan.

Thank you EU governments for the password requirement!!!

Re: What's with the new password requirement?

MadJack70 — Mon, 02 Mar 2026 17:56:00 GMT

I just got one of my EOS R7 bodies back from Canon Factory Service. When my R7 was returned to me, it had a note stating that the firmware had been updated to Version 1.7.1. This required me to assign a password to the camera at powerup and there was no way to bypass the password assignment requirement. I later discovered that I could direct the camera to not ask me for a password to be entered. Afterwards, I called Canon Level 2 Technical Support and asked the following question: "What if I had the password use left turned on and forgot the password?" I was told that the camera would then have to be sent to Canon Factory Service for repair. The Canon Technician did not know exactly how Canon would reset the camera to allow it to again operate. It's possible that a motherboard replacement could be required. So, I guess you could end up spending a quarter to a third of the cost of the camera to ship it to Canon for repairs it if you forget the password. This is not a very customer-friendly option.

Re: What's with the new password requirement?

jrhoffman75 — Mon, 02 Mar 2026 18:02:18 GMT

@MadJack70 wrote:

I just got one of my EOS R7 bodies back from Canon Factory Service. When my R7 was returned to me, it had a note stating that the firmware had been updated to Version 1.7.1. This required me to assign a password to the camera at powerup and there was no way to bypass the password assignment requirement. I later discovered that I could direct the camera to not ask me for a password to be entered. Afterwards, I called Canon Level 2 Technical Support and asked the following question: "What if I had the password use left turned on and forgot the password?" I was told that the camera would then have to be sent to Canon Factory Service for repair. The Canon Technician did not know exactly how Canon would reset the camera to allow it to again operate. It's possible that a motherboard replacement could be required. So, I guess you could end up spending a quarter to a third of the cost of the camera to ship it to Canon for repairs it if you forget the password. This is not a very customer-friendly option.

That is a bogus response.

All that would need to be done is reset the camera. You would lose any custom settings; camera would be back to new out-of-the-box condition.

The password is not for theft protection. It is to comply with an EU requirement for protection of wireless passwords.

Re: What's with the new password requirement?

MadJack70 — Mon, 02 Mar 2026 18:37:54 GMT

John, if you had left the password option turned on and then later forgot the password, you would have no access to the menus to perform a reset. Nor could you reinstall a version of firmware. Perhaps Canon has designed a backdoor for their use in such a case, but the Level 2 Tech Support member had no knowledge of it.

Re: What's with the new password requirement?

Stephen — Mon, 02 Mar 2026 19:13:57 GMT

Hi.

Please watch the part of this video that I've marked:

Re: What's with the new password requirement?

kvbarkley — Mon, 02 Mar 2026 19:30:02 GMT

Don't you see this when asked to enter the password?

No menu needed, just hit "reset"

Re: What's with the new password requirement?

MadJack70 — Mon, 02 Mar 2026 19:31:42 GMT

Stephen, does this mean that the setup menu is accessible on the camera without entering the password at powerup? I guess I never tried that, before disabling the password use.