search

JurajNyiri / HomeAssistant-Tapo-Control

Control for Tapo cameras as a Home Assistant component
Apache License 2.0
953 stars 80 forks source link

❗❗❗Invalid cloud password on firmware build 230921 and higher #551

Open JurajNyiri opened 2 months ago

JurajNyiri commented 2 months ago

Thread for invalid cloud password on firmware build 230921 and higher

There has been reports of users on firmwares 1.3.8, and newer, or on some cameras other firmwares with build 230921 and newer of integration stopping to work. This shows as cloud password not being accepted.

I have been in touch with tplink regarding a security vulnerability I reported in the past and this is most probably a fix for it.

This currently only affects some users, not all and most probably requires camera to be connected to the internet in order to receive the update for authorization, given that it affects older firmwares as well, or possibly an interaction with the official app.

I have a solution and I am waiting for a permission for integration to connect to cloud.

Users reported this problem in numerous issues, this issue will serve for tracking the progress on the fix and group all the conversation under one issue.

Workarounds

If you need to use the camera with this integration until this is resolved you can either:

  1. If your camera still works with integration: Block internet access of camera and stop using the official phone app temporarily if you are using firmware 1.3.8 (or build 230921 and higher)
  2. If your camera no longer works with integration: Use older firmware than 1.3.8 (or build 230921) and factory reset camera

This issue has been locked due to too many users ignoring the request to read first before posting duplicate and off topic content after more than 3 warnings.

This post will stay uptodate with the most recent updates below.

2024-04-11:

First report of the issue at https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/549

2024-04-12:

Second report of the issue at https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/550 along with more users confirming the issue.

2024-04-13:

This thread has been created.

From my side, I have unblocked one of my camera on the latest firmware to reach the internet, so that hopefully I can get this update soon and work on a fix. I hope TPLink will provide detailed instructions on what has been changed so that I can work on a fix.

2024-04-19:

Added instructions about build number as some cameras have different versioning of firmwares.

I reached out to TP-Link after 7 days for any updates.

2024-04-23:

@reypm found a solution how to workaround this issue without downgrading the firmware:

  1. Factory reset the camera (it remains with 1.3.11 Build 231117 firmware since I could not find a way to downgrade the firmware)
  2. Entirely block Internet access for the camera
  3. Reinstalled the component (this component)
  4. Re-added the camera (by reinstalling the component it removes the old config)

TPLink is working on providing me with the solution, got a reply today that I need to wait a bit more.

2024-05-08:

I have some very good news and a little bit of concerning news.

Good news:

  1. Today I was finally affected with this on one of my cameras which allowed me to conduct research and I spent my whole day working on that.
  2. I now know how to solve this, I just need to figure out some of the remaining details and implement the changes which should not take more than a few weekends of active work. There is a lot of work involved but it can be done and I now know roughly how.

Now the concerning news:

  1. Integration will need to interact with tplink cloud to get the new password. This is possibly a one time job, but I do not know yet, it might expire and get a new password if it no longer works. I will need to find a way to detect this as well but thats just a little detail.
  2. Due to integration's need to interact with TPLink cloud I have reached out to TPLink for their permission. If they refuse, there is no way how to implement this unless someone else makes a script to extract the pwd AND the pwd does not change, ever. Which would also make the set up harder for everyone.

2024-05-15:

See https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/551#issuecomment-2111341474

2024-05-18:

See https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/551#issuecomment-2118381739

2024-05-29:

See https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/551#issuecomment-2137323663

2024-06-25:

See https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/551#issuecomment-2189695781

2024-07-03:

See https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/551#issuecomment-2205580658

quentinzil commented 2 months ago

I don't know if this is helpful or if anyone has seen this but mine just suddenly started working again today without any changes.

wavemop commented 2 months ago

I don't know if this is helpful or if anyone has seen this but mine just suddenly started working again today without any changes.

You mean yours were already added in HA !? I tried to add them again but still ... I fear we have to wait for TP-Link to help or downgrade them.

dm82m commented 2 months ago

What I am wondering most is: why is the same new firmware working if we block the cams internet access and reset and add it to HA!?

us243227 commented 2 months ago

curious as to what all this bug now does? I have some cameras I stopped from upgrading - they are at 1.2.6 .... I can trigger them to do things via HA switches etc .... but can no longer get THEM to trigger something. Example - I had an automation setup so that if a pan cam was moved left right etc it would wait 5 min then set the view to preset 1. That no longer works. If I change it to use just a switch to trigger it - that works. I tried a bunch of different examples- does that tie to THIS problem?

blanknam3d commented 2 months ago

Just reporting what I'm experiencing, in relation to this: when I saw this "update" PSA I actually didn't have any issues at all, but sure enough now my cameras don't have working binary sensors for motion, all the buttons & switches no longer work, however the camera's streams still seem to work just fine.

For me at least, it seems one camera stopped working with the integration around when I have the camera set to auto-reboot (4:22 AM, 4:00 to 4:30), and the other camera just stopped working with it two hours ago.

atle85 commented 2 months ago

Running two cameras which on both I suddenly get authentication error for: image

No problems before that. No firmware upgrades as of the past weeks, as I've put that on pause.

Tapo c225 v1 Firmwares v1.0.28 Build 231214

Tapo c225 v2 Firmware v1.0.7 Build 231108

I am not able to log into them again: image image

nerotrobe commented 2 months ago

The workaround of factory resetting the camera, blocking the internet, removing the integration, resetting HA and then readding the integration didn't work for me.

k1lln1n3 commented 2 months ago

checking in with the following devices working with regular external use of the Tapo app & Full internet access:

C200 running 1.3.13 Build 240327 C310 running 1.3.11 Build 231116

I don't mind testing things to try and break the integration on my C310 if anyone has steps to try and recreate the problem beyond using the app externally.

zycarlc commented 2 months ago

I updated the video quality setting via the tapo app today, then the integration broke down. I have tried factory resetting, removed and added back to the tapo app. it did not work for me. C310 1.3.9 build 231024

vitorsemeano commented 2 months ago

Well, I kept monitoring this issue and prevented firmware update on my c220 camera. Out of nowhere, this last weekend, integration went nuts with this authentication error. Nothing is working now. I can try to look into it, no promises.

blanknam3d commented 2 months ago

I updated the video quality setting via the tapo app today, then the integration broke down. I have tried factory resetting, removed and added back to the tapo app. it did not work for me. C310 1.3.9 build 231024

Yeah I think that's what breaks it if the integration is currently working. I used to have it working on the latest firmware until I altered some settings in the app, then suddenly things broke. I then factory reset one of my cameras & it managed to connect back to the integration again, but when I went to rename the camera in the app after the factory reset + connecting it with the integration, the integration broke yet again.

bernfp commented 2 months ago

In my case, integration managing C110, C210 and C510W. Yesterday last one broke down suddenly, the others working fine. The workaround didn't work.

JurajNyiri commented 2 months ago

Please only comment if you have any valuable new information.

Please refrain from posting, for example:

I am still waiting until I am affected, or until TPLink responds with a solution.

Workarounds on how to get your camera working in the meantime are at the top. Only post new and valuable information for resolution. Otherwise DO NOT POST as everyone watching this thread gets notified by email.

I would like to keep this open to anyone to post valuable information, but if the spam continues I will be forced to lock this thread to contributors only.

Dee-san commented 1 month ago

I'm having issues re-adding my Tapo C510W, Firmware 1.2.1 (build 240401).

If I try it, I get

The IP address does not belong to any supported Tapo device

Any news on this?

wehrmannit commented 1 month ago

Hey, my integration just stopped working, so I used HTTP Toolbox Pro to man-in-the-middle myself and record the data that's being sent while opening the app and accessing the not-working camera.

HTTPToolkit_2024-05-08_11-20.zip

https://toolbox.googleapps.com/apps/har_analyzer/

The offending party is IP 192.168.0.29, the others are unrelated thermostats, but I couldn't filter it out.

However, what I did realize is:

When I redo the request to get the stok in Postman, all later requests from the app result in a 500 request.

image

Let me know if you need any more information (such as local password or whatever).

tomtpcz commented 1 month ago

Today TAPO offered me new firmware version 1.2.1 Build 240401 Rel.61067n for C510W hw 1.0 camera. I did this update out of curiosity and now the integration doesn't even recognize the camera anymore. So another step back.

Výstřižek

JurajNyiri commented 1 month ago

I have some very good news and a little bit of concerning news.

Good news:

  1. Today I was finally affected with this on one of my cameras which allowed me to conduct research and I spent my whole day working on that.
  2. I now know how to solve this, I just need to figure out some of the remaining details and implement the changes which should not take more than a few weekends of active work. There is a lot of work involved but it can be done and I now know roughly how.

Now the concerning news:

  1. Integration will need to interact with tplink cloud to get the new password. This is possibly a one time job, but I do not know yet, it might expire and get a new password if it no longer works. I will need to find a way to detect this as well but thats just a little detail.
  2. Due to integration's need to interact with TPLink cloud I have reached out to TPLink for their permission. If they refuse, there is no way how to implement this unless someone else makes a script to extract the pwd AND the pwd does not change, ever. Which would also make the set up harder for everyone.
mateuszdrab commented 1 month ago

I have some very good news and a little bit of concerning news.

Good news:

  1. Today I was finally affected with this on one of my cameras which allowed me to conduct research and I spent my whole day working on that.
  2. I now know how to solve this, I just need to figure out some of the remaining details and implement the changes which should not take more than a few weekends of active work. There is a lot of work involved but it can be done and I now know roughly how.

Now the concerning news:

  1. Integration will need to interact with tplink cloud to get the new password. This is possibly a one time job, but I do not know yet, it might expire and get a new password if it no longer works. I will need to find a way to detect this as well but thats just a little detail.
  2. Due to integration's need to interact with TPLink cloud I have reached out to TPLink for their permission. If they refuse, there is no way how to implement this unless someone else makes a script to extract the pwd AND the pwd does not change, ever. Which would also make the set up harder for everyone.

Thank you for the meaningful update @JurajNyiri

I hope that they will not refuse to agree us users to manage the cameras we own and use their APIs. I am really concerned with the direction the industry is going.

As mentioned by Luis Rossmann, TP Link is actually one of a few companies that allow you to stream RTSP and have a reasonably usable API. I wonder if TP Link would like Luis to post an update on this... should they disagree, I'll try to get in touch with him.

I think we need to put some pressure on them as a group of users if they disagree, as we own the devices and should be able to control them without being reliant on the cloud.

I dare to say we should be able to control them locally with the generated local user and password. Why is the cloud even needed here...

Is there a way for us to voice our opinion to TP Link?

The cameras are so dumb without Home Assistant's control and please let's not allow them to say that their built in routines with 4 available actions are good enough.

JurajNyiri commented 1 month ago

@mateuszdrab absolutely agree. I would recommend waiting for the response first as they have been helpful so far in our topic of vulnerability. They have not sent the instructions yet which made the work a lot harder but I understand it takes time for such a big company as I work in one and these types of requests have to go through a lot of meetings first usually.

They are aware about this repo and it wouldn’t surprise me if someone is monitoring this issue as well.

Personally I feel that so far this integration has been pure net positive for them as I and other contributors are doing this work for free and with best ethics and intent in mind. So I do not personally see any reason why they would reject to give me permission, but as you said worse things have happened in the industry lately so we shall see.

JurajNyiri commented 1 month ago

Just a small update:

  1. I progressed with the code a lot, there are still ways to go though but path is mostly clear (only one more thing to find out).

Once it is implemented in pytapo there will be quite a lot of work on Tapo integration itself to make it user friendly.

  1. I heard back from tplink in response to my email from yesterday, but no permission yet. I suggested a meeting to clear up the confusion that seems to be present, sent them a link to this issue and hopefully the meeting will be able to accelerate the process.
gunverth commented 1 month ago

I’m using Tapo Control 5.4.13 on HAOS 2024.5.2 with several Tapo C100 on Firmware 1.3.11 Build 231121 Rel.39420n(4555) without any issues. Automatic updates on cameras.

DavidFW1960 commented 1 month ago

I just got hit with this. I'm on firmware1.3.13 build 240327 it just won't accept the password. Hope you get this fixed soon

NathanBeirens commented 1 month ago

For the TP-Link rep reading this issue.

I'm looking into buying some new camera's. My purchase decision (and recommendations for friends, family & the community) will depend on how tp-link handles this.

The base functionality of a device that I purchased should not depend on a cloud connection. A device that is permanently dependent on a cloud connection is a device that should not be sold, these should only be rented out to the customer.

I know I'm not the only customer who has this opinion. www.youtube.com/watch?v=3OobgIx-Wf0

dm82m commented 1 month ago

For the TP-Link rep reading this issue.

I'm looking into buying some new camera's. My purchase decision (and recommendations for friends, family & the community) will depend on how tp-link handles this.

The base functionality of a device that I purchased should not depend on a cloud connection. A device that is permanently dependent on a cloud connection is a device that should not be sold, these should only be rented out to the customer.

I know I'm not the only customer who has this opinion. www.youtube.com/watch?v=3OobgIx-Wf0

Just go this way and you are not depending on cloud, you are just using the cam locally and it works. So basically all you are complaining about is already working: https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/551#issuecomment-2070843924

JurajNyiri commented 1 month ago

Downgrading is not a long term solution at all. Especially for new cameras and user experience.

JurajNyiri commented 1 month ago

For the TP-Link rep reading this issue.

I'm looking into buying some new camera's. My purchase decision (and recommendations for friends, family & the community) will depend on how tp-link handles this.

The base functionality of a device that I purchased should not depend on a cloud connection. A device that is permanently dependent on a cloud connection is a device that should not be sold, these should only be rented out to the customer.

I know I'm not the only customer who has this opinion. www.youtube.com/watch?v=3OobgIx-Wf0

The solution I am working for is going to require one time sync of token with cloud and then it will work fully locally unless the token changes for any reason.

I shared more details with TPLink and am waiting for their permission for the integration to connect to cloud for this purpose.

blanknam3d commented 1 month ago

For the TP-Link rep reading this issue.

I'm looking into buying some new camera's. My purchase decision (and recommendations for friends, family & the community) will depend on how tp-link handles this.

The base functionality of a device that I purchased should not depend on a cloud connection. A device that is permanently dependent on a cloud connection is a device that should not be sold, these should only be rented out to the customer.

I know I'm not the only customer who has this opinion. www.youtube.com/watch?v=3OobgIx-Wf0

+1 on this for the TP-Link rep: I recently bought two Tapo C200 cameras, specifically because this integration existed & provided comparable features to what I had with Yi Home cameras using the yihack integration (albeit, more reliably than Yi cams with modified firmware!), as well as TP-Link's network products having a pretty great track record of quality with me. I actually am using them for the purpose of monitoring a special needs adult more than I am for security, and the deep level of control this integration provides helps a great deal with taking care of him, especially when it comes to monitoring & controlling his behavior whenever he stays awake past everyone's bedtime.

ex. During the day, I have my cameras set to not track motion as the motor noises can be annoying, but at night I have Home Assistant enable motion tracking for a camera in the kitchen - intended to ensure that if he takes something from the kitchen, he's caught doing so. I also use the sound sensor to send alerts + play a pre-recorded audio message to remind him that a camera is watching, specifically during sleeping hours, in the event that he smashes something or goes through the cabinets while everyone's asleep

There's also the ability to trigger the device's alarm on-demand through the integration - with that specific feature in this integration, I've managed to save a fair few dishes from his mischief, as well as save a good amount of time that would've been used to clean up the remains of broken plates...

If this integration becomes completely unusable at some point, I'd likely have to replace these cameras with something else. I don't want to have to do that, as I got the cameras literally only 3 months ago & the only remaining options I have for my use case are either currently too expensive or unreliable. If they drop the ball on this, I'd have no problem dropping them from my future home network upgrades.

I really hope TP-Link does the right thing for us, especially as the 1.3.7 firmware I'm currently running on them to use this integration has an annoying bug, where sometimes my cameras will fight each other to use the same IP address simultaneously on the network & kick each other offline until I intervene - even though their IPs are specifically reserved in my router's DHCP reservation settings. That's fixed in the latest firmware, though obviously I currently don't have the option of updating to that firmware.

RertrandBussell commented 1 month ago

Just to add more for any TP-Link rep: same here, I bought two Tapo Cameras to test the viability for my HA setup and in case this works fine I will buy at least 8 more. If it doesn't work I'll have to move to another vendor.

krasatos commented 1 month ago

Would it help if a bunch of us also raised the issue with Tp-link? Or would it make it worse? :)

JurajNyiri commented 1 month ago

Update:

So technically speaking, there are 0 blockers left apart from time I need to finish working on this.

With all that being said, I am not feeling comfortable releasing this without the TPLink approval, as I am not a lawyer and so far everything in this integration was in one way or another already documented on the internet and the integration was fully local. I do not want this repo to be taken down or face any issues personally even though I know it is common in the industry for integrations to communicate with cloud, including undocumented APIs (and it is, to the best of my knowledge and research, legal, under laws such as, but not limited to, achieving interoperability with devices) . Still, I am not a lawyer, I am doing this for free and as a hobby and under best ethics and intent in mind for all the parties involved. Because of this, cloud is where I personally draw a line for the need of approval. I believe this integration brings only positive value to every party, but ultimately, the decision is on TPLink. I trully hope, and believe TPLink will do the right thing.

So, for the next actions:

🤞 Let's hope for the best.

kankadev commented 1 month ago

Your integration is not the only one which is broken. I can't even use "motion" with simple RTSP anymore. All my 12 Tapo cams are useless now.

Thanks for your work. But IMHO I have to change all cameras since this is not the only reason. They try to force you to buy their cloud service which I did but you can't trust this service. Sometimes I check the recordings in the cloud and I wonder why there are 0 recordings in a few days!!! I have to restart the camera then and have my average 500 recodings / day again but of course lost the last days. This happens because of Tapos own limitation of max 2 connections. If you have a SD card inside the cam THAT'S the first "connection". If you use their cloud it's a connection, too.

fmarzocca commented 1 month ago

I have 2 C200 (v.1) cameras, both with firmware 1.3.9 One of them is perfectly working, the other one gives me the "Authorization" issue.

tapo = Tapo("192.168.1.56", user, password) is working, tapo = Tapo("192.168.1.69", user, password) is not working!

Very weird, the 2 cameras are on the same LAN.

officedrone commented 1 month ago
  • pytapo is mostly done and works 100%. Just some refactoring left and readme updates to do. It keeps the cloud communication to the absolute minimum and introduces itself to cloud servers appropriately keeping in mind best practices and ethics. It only ever reaches out to cloud if it knows email and password, the camera requires the new cloud token, and if the new token is not present.
  • Integration will store the token so after initial auth and setup (or reauth), it will never, ever, reach out to cloud again, unless the token gets invalidated. And in case where token gets invalidated, it will not do so automatically and will require user to go through reauth flow in order to minimize any chance of possible bugs introducing unnecessary load on cloud servers.

First of all, truly appreciate all the hard work! You guys are superstars!!

Maybe a silly question, but is there theoretically a method to generate the Auth token outside of the integration (e.g. Via postman/api call script with the appropriate attributes) and then upload/store it in the integration manually?

That way the integrarion/Home Assistant can remain without cloud interaction and the user can do one-time token generaruon from a client device.

I know this, if possible, carries additional considerations around how the token is handled/stored on the client device), but it could be another option for people that really don't want the Home Assistant interaction with the Tp-Link Cloud.

Again really appreciate you working on this so diligently!

Cheers!

JurajNyiri commented 1 month ago

Maybe a silly question, but is there theoretically a method to generate the Auth token outside of the integration (e.g. Via postman/api call script with the appropriate attributes) and then upload/store it in the integration manually?

That way the integrarion/Home Assistant can remain without cloud interaction and the user can do one-time token generaruon from a client device.

I know this, if possible, carries additional considerations around how the token is handled/stored on the client device), but it could be another option for people that really don't want the Home Assistant interaction with the Tp-Link Cloud.

Yes, it's a lot more complex than simple postman requests, but in a nutshell, it is in fact how it will work in the new version of pytapo once allowed to be released. In fact, the version of integration out today works seamlessly, all that needs to be done is this token needs to be used instead of cloud password.

Now there might be more ways than one on how to get this token:

  1. From cloud -- this is the option I discovered
  2. From app local storage on phone? No idea if app stores it locally... Might require root, idk.
  3. TPLink adds it into the official app section for copy paste into 3rd party integrations (as suggested, the best solution really)
  4. ?

Ultimately, if TPLink agrees for Integration (and therefore pytapo) release the logic needed connected with cloud and extraction of the token, it should be implemented on Integration level so that users do not need to use python (or any other CLI) and it is clear what minimal data points are needed from them. Be it only "3rd party acc" (the rtsp one) for old firmwares, cloud pwd for newer ones or this cloud token for the newest ones.

Now, if they disagree, I will not be able to release the extraction at all which gets me personally into deadlock with any kind of solution, including accepting PRs. I am not the only dev out there, and someone else might release the logic or CLI tool, if they are not concerned. As I stated previously, reverse engineering and releasing code interacting with cloud crosses a comfort line for me, even if I believe it is in fact ethical, and legal for the purposes here.

Just in case someone thinks about contacting me in regards of extraction of the token - please do not, at this point I am waiting for TPLink approval. If they refuse, I am not sharing anything. I will not go against their wishes.

If and when that happens, the genie is out of the bottle and nobody can get it back. Even if that happens though, with the decision they would've made in this case, I would be concerned of more breaking changes coming next with the purpose of breaking the integration (or cloud part) so an entirely different discussions will need to be had. I will not ever play the cat and mouse game with any company trying to actively break open source integrations. I consider the HA integrations a huge value for companies and if they do not want them, they shall not have them (see myq case for example).

We are not there at all though so we should not be concerned at all yet. In fact, all the comms I had so far show me the opposite, a good intent and solution for everyone, and I personally hope and believe they will agree. As stated previously, I have no interest in interacting with cloud more than absolutely necessary (only on setup, and only if required) and am keeping any possible concerns I would have had in their place in mind when developing this extraction and interaction with cloud.

I received an update yesterday from TPLink. They are evaluating everything I shared, my request for permission, and ask me to be patient. I understand these decision take time and this decision once made, could have in my opinion huge benefit for all parties involved going forwards (especially positive to reputation).

botas11 commented 1 month ago

I believe that the token can be extracted locally using the same procedure that local tuya uses.

https://youtu.be/YKvGYXw-_cE

JurajNyiri commented 1 month ago

@botas11 that might be worth investigating. Let us know if you are successful in extraction that way.

If it stores the key and it works it can be a (hopefully) temporary workaround - it is really not very user friendly though.

botas11 commented 1 month ago

@botas11 that might be worth investigating. Let us know if you are successful in extraction that way.

If it stores the key and it works it can be a (hopefully) temporary workaround - it is really not very user friendly though.

Sorry Im not sure about the format of the key or how to test if it works... from the files I have got some promising fields...

tp_iam_sp.xml

<map>
<string name="tp_token_info_keyprdxxxxxxx">{"token":"Bearer IT HAST THE BEARER KEY HERE","ttl":xxxxxxx}</string>
<string name="prdxxxxxxx">https://iac.tplinknbu.com|xxxxxxx</string>
<string name="tp_iam_server_url_key">prdxxxxxxx</string>
</map>

aria_sp.xml

<map>
<string name="SP_ACCOUNT_MFA_GRAY_CONFIG_NAMExxIT HAS A STRING HERExx">IT HAS A STRING HERE</string>
<string name="SP_ACCOUNT_SERVER_URLxxIT HAS A STRING HERExx">IT HAS A STRING HERE</string>
<boolean name="sp_is_old_cameraxxIT HAS A STRING HERExx" value="true"/>
<string name="latest_iot_device_cache_xxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<boolean name="sp_subscribe_msg_init_flag_xxIT HAS A STRING HERExx" value="true"/>
<string name="SP_TAPO_CARE_URLxxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<string name="SP_ACCOUNT_MFA_CONFIGxxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<boolean name="sp_is_old_cameraxxIT HAS A STRING HERExx" value="true"/>
<string name="sp_cipc_urlxxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<boolean name="sp_tapo_iot_ban_local_lv1_canary_user_xxIT HAS A STRING HERExx" value="false"/>
<string name="LAST_LOGIN_ACCOUNT_KEY">IT HAS A STRING HERE </string>
<int name="sp_camera_bind_tapo_care_statusxxIT HAS A STRING HERExx" value="-1"/>
<int name="sp_kasa_data_migration_status_xxIT HAS A STRING HERExx" value="2"/>
<boolean name="first_time_active_login_user" value="true"/>
<boolean name="sp_tapo_trv_ob_control_feature_canary_xxIT HAS A STRING HERExx" value="false"/>
<string name="last_post_fcm_token">IT HAS A STRING HERE </string>
<int name="sp_camera_bind_tapo_care_statusxxIT HAS A STRING HERExx" value="-1"/>
<string name="sp_tpa_dist_s">IT HAS A STRING HERE </string>
<boolean name="sp_subscribe_msg_firmware_xxIT HAS A STRING HERExx" value="true"/>
<string name="deco_sp_key">IT HAS A STRING HERE </string>
<string name="ACCOUNT_NICKNAME_PREFIX_xxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<long name="sp_voice_control_login_first_time_key_xxIT HAS A STRING HERExx" value="xxIT HAS A STRING HERExx"/>
<boolean name="sp_is_old_cameraxxIT HAS A STRING HERExx" value="true"/>
<string name="deco_sp_vector">IT HAS A STRING HERE </string>
<string name="sp_system_notification_filters_xxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<int name="sp_email_topic_has_show_times_xxIT HAS A STRING HERExx" value="1"/>
<int name="sp_camera_bind_tapo_care_statusxxIT HAS A STRING HERExx" value="-1"/>
<boolean name="sp_showed_subscription_entrance_xxIT HAS A STRING HERExx" value="true"/>
<boolean name="sp_ffmpeg_feature_canary_xxIT HAS A STRING HERExx" value="false"/>
<string name="sp_tpa_dist_k">IT HAS A STRING HERE </string>
<int name="sp_acl_auth_statusxxIT HAS A STRING HERExx" value="0"/>
<boolean name="rate_us_tapo_3_dot_0_has_show" value="true"/>
<string name="latest_iot_device_cache_xxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<long name="sp_check_google_service_xxIT HAS A STRING HERExx" value="xxIT HAS A STRING HERExx"/>
<string name="upload_user_experience_improvement_enable_xxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<int name="SP_ACCOUNT_MFA_GRAY_CONFIG_VERSIONxxIT HAS A STRING HERExx" value="4"/>
<boolean name="sp_geofencing_status_xxIT HAS A STRING HERExx" value="false"/>
<boolean name="sp_is_old_cameraxxIT HAS A STRING HERExx" value="true"/>
<boolean name="sp_has_agree_privacy_policy" value="true"/>
<boolean name="SP_HAS_RECORD_CACHE_DEVICE_LIST" value="true"/>
<boolean name="SP_ACCOUNT_MFA_CONFIG_ENABLE_STATExxIT HAS A STRING HERExx" value="true"/>
<boolean name="is_enable_user_experience_improvement" value="true"/>
<string name="ENCRYPT_UUID_KEY">IT HAS A STRING HERE</string>
<long name="sp_last_time_email_topic_show_xxIT HAS A STRING HERExx" value="xxIT HAS A STRING HERExx"/>
<int name="sp_downgrade_handel_show_times_xxIT HAS A STRING HERExx" value="0"/>
<string name="latest_iot_device_cache_xxIT HAS A STRING HERExx">IT HAS A STRING HERE </string>
<string name="sp_iac_dist_s">IT HAS A STRING HERE </string>
<boolean name="sp_ring_call_canary_user_xxIT HAS A STRING HERExx" value="false"/>
<int name="sp_canary_user_data_migration_status_xxIT HAS A STRING HERExx" value="2"/>
<boolean name="sp_tapo_smart_action_v2_canary_user_xxIT HAS A STRING HERExx" value="false"/>
<int name="user_improvement_version_code_xxIT HAS A STRING HERExx" value="1464"/>
<string name="sp_iac_dist_k">IT HAS A STRING HERE </string>
<boolean name="sp_has_already_filter_old_cameraxxIT HAS A STRING HERExx" value="true"/>
<long name="sp_lase_ring_related_permission_log_time" value="xxIT HAS A STRING HERExx"/>
<int name="sp_camera_bind_tapo_care_statusxxIT HAS A STRING HERExx" value="-1"/>
</map>
JurajNyiri commented 1 month ago

What you are looking for is a 64 characters long alphanumeric string that will be different for each camera.

You can try it out by using the currently released integration and using it instead of your tplink cloud password for the affected camera or simply by pytapo and using "admin" username and the string as the password.

JurajNyiri commented 1 month ago

Everything is ready.

Screenshot 2024-05-17 at 21 12 05 Screenshot 2024-05-17 at 21 12 15

... for some old cameras, the setup ends here (unless recordings access is required).

Screenshot 2024-05-17 at 21 15 57

...for the most cameras before this update, the setup ends here. Now for the new firmwares...

Screenshot 2024-05-17 at 21 21 09

... and if the camera is offline, one additinal step.

Screenshot 2024-05-17 at 21 13 14 Screenshot 2024-05-17 at 21 33 09

Above supported both for reauthentication and new setup.

Notes

Now, we wait...

jjvelar commented 1 month ago

Thanks for your effort

El El vie, 17 may 2024 a las 23:04, Juraj Nyíri @.***> escribió:

Everything is ready. Screenshot.2024-05-17.at.21.12.05.png (view on web) https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/assets/5785999/4dec3b4b-161c-48b5-bf21-3dac6a209d98 Screenshot.2024-05-17.at.21.12.15.png (view on web) https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/assets/5785999/b18eff6c-3250-4738-89ae-364ed3aedc78

... for some old cameras, the setup ends here (unless recordings access is required). Screenshot.2024-05-17.at.21.15.57.png (view on web) https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/assets/5785999/396eb7d7-5102-45f6-a178-6f4106c8e64a

...for the most cameras before this update, the setup ends here. Now for the new firmwares... Screenshot.2024-05-17.at.21.21.09.png (view on web) https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/assets/5785999/ab9bfe11-95cf-4ef3-b533-23c5dc6e0da6

... and if the camera is offline, one additinal step. Screenshot.2024-05-17.at.21.13.14.png (view on web) https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/assets/5785999/056a85e7-8ac9-43f9-8d12-cc38ec9a420d Screenshot.2024-05-17.at.21.33.09.png (view on web) https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/assets/5785999/2313c688-70fc-46f9-833f-90377f962c46

Above supported both for reauthentication and new setup. Notes

  • Fully local after setup.
  • All different failure and success flows tested for many different camera fws.
  • Without storing email address anywhere.
  • With absolute minimum requests going out to cloud.
  • Including information for email notification about new sign in containing Home Assistant version and unique device ID.
  • New simplified setup for pytapo with new readme instructions for all the different types of authorization.
  • Cloud account password previously required is removed completely from HA if token is available, improving security in case of HA filesystem instance breach.
  • With the best intent and practices in mind.

Now, we wait...

— Reply to this email directly, view it on GitHub https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/issues/551#issuecomment-2118381739, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALKMG4TK2WGE6ZAX2J6B7UTZCZWGRAVCNFSM6AAAAABGFXTRQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMJYGM4DCNZTHE . You are receiving this because you commented.Message ID: @.***>

krasatos commented 1 month ago

Incredible support as always, thank you!

Now, we wait...

Are we waiting for TP-Link's OK?
Or will an update pop up in HACS soon?

JurajNyiri commented 1 month ago

We are waiting for TP-Link’s permission to release the code interacting with cloud in order to get the token.

RertrandBussell commented 1 month ago

My experience with companies like that is that nobody would ever have noticed it, but now that they are asked they will take months before they reply and then just say it's not possible for some arkane legal reason. Let's just hope TP-Link is a welcome exception.

isabellaalstrom commented 1 month ago

My experience with companies like that is that nobody would ever have noticed it, but now that they are asked they will take months before they reply and then just say it's not possible for some arkane legal reason. Let's just hope TP-Link is a welcome exception.

In the latest months there have been several companies not only noticing but also threatening legal action so I understand this decision from the author.

davefx commented 1 month ago

Is there any method to retrieve the key manually? If Tapo doesn't answer it would be great if we can use a manual method to retrieve the key and to fill it into the camera configuration, so we stop having un-automated cameras at home.

javierugarte commented 1 month ago

Hello,

I have sent an email to Tapo support to inform them that this integration is making a great effort to work with their cameras. If they do not provide a solution, I will sell all the cameras and switch to another brand. Hopefully, by putting a bit of pressure on them, we can get a response.

Thank you @JurajNyiri the effort made.

clintferns2911 commented 1 month ago

To be honest, I don't think once you've bought the product from the company that they really care much if you sell it don't use it or replace it. I do hope I'm proved wrong.

jsapede commented 1 month ago

they dont care, ... if they care, they would natively give local acces to the camera to their customers ....

JurajNyiri commented 1 month ago

Please only comment if you have any valuable new information.

Please refrain from posting, for example:

We are now waiting for TPLink to give me permission to release the code that extracts the token from cloud.

Workarounds on how to get your camera working in the meantime with all the updates are at the top. Only post new and valuable information for resolution. Otherwise DO NOT POST as everyone watching this thread gets notified by email.

I would like to keep this open to anyone to post valuable information, but if the spam continues I will be forced to lock this thread to contributors only.

MLammerding commented 1 month ago

I'm sing a C200 with 1.3.13 firmware and I'm using no cloud, all running only local. So why do I need this 'cloud' password which I don't have ? What can I do to get the camera back in my HA ? The camera is show fine in Tapo app on my Android devices

Rollback their firmware as stated in the first post. He is still investigation the issue.

OK; but .... there is no way to downgrade, because there is no firmware archive available for my device

You can follow downgrade proccess from here nervous-inhuman/tplink-tapo-c200-re#4 Here is actual list of firmwares nervous-inhuman/tplink-tapo-c200-re#4 (comment)

I went through it previously

Is the a possibility to update the list of the old firmwares? The list is about 7 month old - I would love to downgrade to the last one working. Thx o lot, you're doing a great job!✌🏻