EOS R5 how to bypass password

[pjscott51]

Hi I just updated my r5 to firmware 2.2.1.

Now every time I turn on my r5 I have to enter a password.

I have tried, do not ask again but that doesn't do any good.

I'm sure no one has thought, I wish I had to enter a password when I turn on my camera.

How can I bypass entering the password?

Thanks

[pjscott51]

I understand that it's EU that's causing the problem but I don't think I should be forced to use a password since I live in the US. 

[johnrmoyer]

I guess that you would not want your camera to have a password. 

Since the camera can connect to the internet, the camera having a password benefits everyone else except you because that prevents the camera from easily becoming part of a botnet. 

https://en.wikipedia.org/wiki/Botnet 

[March411]

While it's a pain because nothing was really published/communicated well I understand why you would have that feeling pjscott51. It could have been communicated much better with the roll out.

That being said IMO Canon did what they could to be compliant and give us the option not to use the password. If you think about it, had Canon communicated with the rollout of the new firmware how to turn it off people would have been less aggravated. 

[LeeP]

This presumes I value my camera being connected to the internet, which I do not.

[March411]

Honestly Lee I don't understand why you are so bothered by it.

You don't want to use the functionality simply turn it off and everything is as it was prior to the firmware release. Understanding why Canon did it, to comply with the law I would think users/consumers would be supportive. It's like every other function in your camera menu, like it use it, don't like it shut it off.

[kvbarkley]

Ken Rockwell's take:

https://www.kenrockwell.com/canon/eos-r/passwords.htm

He says it is not because of wifi, but because the facial recognition data that might be saved is "personal information".

[johnrmoyer]

---

@kvbarkley wrote:

Ken Rockwell's take:

https://www.kenrockwell.com/canon/eos-r/passwords.htm

He says it is not because of wifi, but because the facial recognition data that might be saved is "personal information".

---

https://www.sciencedirect.com/science/article/pii/S0267364924000761 

Computer Law & Security Review Volume 54, September 2024, 106009

Abstract

Internet of Things (IoT) is an ecosystem of interconnected devices (IoT devices) that is capable of intelligent decision making. IoT devices can include everyday objects such as televisions, cars and shoes. The interconnectedness brought forth by IoT has extended the need for cybersecurity beyond the information security realm into the physical security sphere. However, ensuring cybersecurity of IoT devices is far from straightforward because IoT devices have several cybersecurity challenges associated with them. Some of the pertinent cybersecurity challenges of IoT devices in this regard relate to: (i) Security During Manufacturing, (ii) Identification and Authentication, (iii) Lack of Encryption, (iv) Large Attack Surface, (v) Security During Updates, (vi) Lack of User Awareness and (vii) Diverging Standards and Regulations.

Against this background, the Cyber Resilience Act (CRA) has been proposed to complement the existing EU cybersecurity framework consisting of legislations such as the Cybersecurity Act and the NIS2 Directive. However, does the CRA provide a framework for effectively combating the cybersecurity challenges of IoT devices in the EU? The central crux of the CRA is to lay down and enforce the rules required to ensure cybersecurity of ‘products with digital elements’, which includes IoT devices. To this end, several obligations are imposed on manufacturers, importers and distributors of IoT devices. Manufacturers are mandated to ensure that the essential cybersecurity requirements prescribed by the CRA are met before placing IoT devices in the market. While the cybersecurity requirements mandated by the CRA are commendable, the CRA suffers from several ambiguities which can hamper its potential impact. For instance, the CRA could provide guidance to manufacturers on how to conduct cybersecurity risk assessment and could clarify the meanings of terms such as “limit attack surfaces” and “without any known exploitable vulnerabilities”.

When the fundamental themes of the CRA is analysed from the prism of the cybersecurity challenges of IoT devices, it becomes clear that the CRA does provide a foundation for effectively addressing the cybersecurity challenges of IoT devices. However, the expansive wording in various parts of the CRA, including in the Annex I Requirements, leaves scope for interpretation on several fronts. Consequently, the effectiveness of the CRA in tackling the Security During Manufacturing Challenge, Identification and Authentication Challenge, Large Attack Surface Challenge and Diverging Standards and Regulations Challenge would be largely contingent on how harmonised standards develop and how the industry adopts them. The CRA seems to be more effective, albeit not fully so, in significantly addressing the Lack of Encryption Challenge, Security During Updates Challenge and Lack of User Awareness Challenge of IoT devices. However, the manner in which the CRA addresses all these cybersecurity challenges could be improved upon if an agency such as the ENISA was given the legal mandate to set elaborate standards for cybersecurity requirements under the CRA.