What's with the new password requirement?

[Davoud]

Is this really necessary? Is there a bypass to avoid entering a password? If not, and if you find or steal my R5 or R5 Mk II, try 999999.

[kvbarkley]

https://community.usa.canon.com/t5/Learn-With-Canon/Firmware-Security-Features/ba-p/561532

[Davoud]

Yeah. People go nuts, get overzealous.

[kvbarkley]

The buzz around here is that it is an EU requirement

[LeeP]

Yes the EU is more "proactive" or "nanny state" depending on how you see it and it has a ripple effect to elsewhere.

Porsche for example cannot build the gas-powered Macan--their cash cow--due to some cybersecurity nonsense because the "architecture" of the car won't allow it to be upgraded easily. 

And while I am all for cybersecurity, a password on my camera seems antithetical to me. I understand why it's there and the reasoning behind it.

[p4pictures]

I am pretty sure this is a case of bureaucrats making rules with no consideration of how photographers use cameras

[johnrmoyer]

Radio Equipment Directive 2014/53/EU with extension according to Commission Delegated Regulation (EU) 2022/30

ETSI EN 303 645 (Cyber Security for Consumer Internet of Things: Baseline Requirements)

CEN/CENELEC EN 18031-1, EN 18031-2 and EN 18031-3:

EN 18031-1: Radio equipment with an internet connection

EN 18031-2: Radio devices that process data

EN 18031-3: Internet-enabled radio devices that process virtual money or monetary values

https://ib-lenhardt.com/kb/faq/radio-equipment-directive-red#cybersecurity-requirements 

Cybersecurity & Emerging Technologies

Wireless innovation and increasing device connectivity bring new
regulatory challenges under the Radio Equipment Directive (RED). To
address risks such as unauthorized access, data breaches, and spectrum
congestion, the EU has expanded RED requirements for cybersecurity,
interoperability, and spectrum efficiency. These provisions are
especially relevant for manufacturers of IoT devices, 5G products, and
smart home technologies.

Cybersecurity Requirements (mandatory from August 2025)

From August 1, 2025, new cybersecurity requirements under Articles
3(3)(d), (e), and (f) of the RED become legally binding. These cover
software protection, secure data handling, and fraud prevention. The
following harmonized standards provide a presumption of conformity—with
restrictions:

EN 18031-1:2024 – Internet-connected radio equipment

EN 18031-2:2024 – Devices processing personal data (e.g. toys, wearables)

EN 18031-3:2024 – Devices used for virtual or financial transactions

However, these standards do not provide a presumption of conformity in the following cases:

If users can bypass or disable password requirements (clauses 6.2.5.1, 6.2.5.2)

If parental access control is not ensured in applicable equipment categories (EN 18031-2:2024, clauses 6.1.3–6.1.6)

If assessment relies solely on explanatory sections like “Rationale” or “Guidance”

In such cases, manufacturers must conduct a full conformity assessment, possibly involving a Notified Body, as specified in EU Decision (EU) 2025/138.

Preparing for RED compliance with cybersecurity requirements for IoT?
Learn more about test procedures and applicable standards—such as EN 303
645 and EN 18031—on our IoT cybersecurity certification page. 

[LeeP]

Typical of lawmakers everywhere, but they believe that writing an all-encompassing law solves the problem--even if the "problem" is a false narrative--and they further believe that they (1) do not need to understand the issue and that (2) they know better anyway. I'd rather have society be under-regulated than over-regulated, but until I am the King of Everything my input isn't being sought by politicians. This requirement for cameras is patently idiotic in my estimation. I don't plan to update the software.

[johnrmoyer]

---

@LeeP wrote:

Typical of lawmakers everywhere, but they believe that writing an all-encompassing law solves the problem--even if the "problem" is a false narrative--and they further believe that they (1) do not need to understand the issue and that (2) they know better anyway. I'd rather have society be under-regulated than over-regulated, but until I am the King of Everything my input isn't being sought by politicians. This requirement for cameras is patently idiotic in my estimation. I don't plan to update the software.

---

Warning: off topic philosophy is included in my response

I have not found the firmware update to cause any problems on my EOS R5. It also has no benefit to me since I do not use the wifi built into the camera for ftp data transfers. 

The problem being solved is the huge number of devices with radios that are connected to the internet without any bit of security, much less security updates. These devices are formed into botnets used to attack businesses, governments, and even hospitals. https://www.schneier.com/tag/internet-of-things/ 

A simplified explanation: https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/ 

security expert Bruce Schneier argued that the universe of IoT things will largely remain insecure and open to compromise unless and until government steps in and fixes the problem.

“When we have market failures, government is the only solution,” Schneier wrote. “The government could impose security regulations on IoT manufacturers, forcing them to make their devices secure even though their customers don’t care. They could impose liabilities on manufacturers, allowing people like Brian Krebs to sue them. Any of these would raise the cost of insecurity and give companies incentives to spend money making their devices secure.”

A regulation is needed because there is otherwise no incentive for the manufacturer to attempt to secure the device. The costs of insecurity are a burden on others and not the manufacturer. This is what economists call a negative exeternality. The basic concept is that your freedom does not allow you to impose costs on others.

[Waddizzle]

I’m blaming Tony Northrop.  He’s been suggesting adding password security to cameras for years.