‘End-to-end encrypted’ smart toilet camera is not actually end-to-end encrypted
Kohler, the makers of a smart toilet camera, can access customers' data stored on its servers, and can use customers’ bowl pictures to train AI.
https://techcrunch.com/2025/12/03/end-to-end-encrypted-smart-toilet-camera-is-not-actually-end-to-end-encrypted/Open linkView original on infosec.pub
62 replies
To be fair, that still may be end to end encrypted, just not the ends you were hoping for.
Rear end to backend
Requiem for a video stream
Enshittification
Something that starts as shit is distinctly not enshittified. It's just shit. Don't muddy the term.
shittification.
FecAI™
a subsidiary of excrement LLc.
I don’t know what is more stupid, that this exists or that it’s $600 plus $7/month.
Yes.
toilet. camera.
ummm… no thanks
It already does, just that it's shit I say
If it was all local it could really improve societies health. I'd kinda rather something like that be 100% local though, no internet access.
Exposed port 31337.
Shut up and take my upvote..
I like how they refer to BO as a administration tool when really it was an exploit tool that had the side effect of some nifty administration ability,
It was significantly more reliable than sub7, which usually was itself infected.
TFW you spend $600 a month on a subscription iot toilet camera just to find out it's been taking pictures from inside your toilet and sending them over the internet!
Why do people want a toilet cam in the first place?
Cancer and stuff
Like....butt stuff?
Sometimes I do, but nothing crazy, just a pinky or whatever.
Urine and stool samples can indicate a person’s health and evaluate some conditions, such as over/underhydration or a lack of fiber. If there’s blood in the urine, a picture could allow a doctor to evaluate whether it’s a UTI or a kidney stone.
I’d even say it’s a scenario where machine learning could be used to train a computer to recognize many of those scenarios and offer suggestions to improve one’s health.
Is that worth $600 and a subscription fee when you could learn to recognize those things yourself and take a picture for your doctor if it’s needed? Maybe if you’ve got money to burn.
It you have that much blood in urine or feces, you are in bad shape.
I just post my turds on insta for free assessment by close friends.
Is this a low-key kink shame or genuine ignorance?
You’re saying it’s a kink thing?
💀
https is end to end
surely, once I read this article, I'll find they implemented ssl
edit:
as I suspected, Kohler is one of the ends of the e2ee. and it is implemented. what is the news here exactly
Https is the transit. End to end encrypted means it's encrypted before, during, and after transit. Ie the data at rest would/should be encrypted
and Kohler said they are encrypting the data at rest
They also said they decrypt after transit before they encrypt at rest, so it's not encrypted in between and they can look at your data. So it's not e2e if you want both ends to be you.
I think what your talking about is zero knowledge. but that's not what was promised.
Absolutely not. E2EE means it's encrypted from end to end. If I send data and I'm also the person to receive it on my app to inspect it, I'm both ends and the data should not be decryptable in between by anybody else if it's advertised as e2ee. Zero knowledge on the other hand doesn't mean that you transfer information securely but that you can prove that you have some information without it ever even being sent.
That's not what end to end encryption means. All encrypted transmissions are not end to end encrypted.
if Kohler is the other end of your transmission, and the data is encrypted til they decrypt it, it's e2ee. if you disagree, try explaining why.
Because that's plainly not what end to end encrypted means. That's just HTTPS.
They're providing the service. End to end encryption maintains an encrypted communication channel between two clients that the service provider cannot decrypt.
By your definition, all HTTPS traffic would be end to end encrypted.
The term "end to end encryption" is just not applicable to this context and using it as marketting to users in order to give them a false sense of security is disingenous.
Waiting for the first leaked celebrity poop.
From the perspective of the Kohler toilet camera being the sender and the Kohler shit-reviewing service being the recipient, TLS can technically be end-to-end encryption. As long as the shit-reviewing server is doing the TLS termination itself—and not Cloudflare or a reverse proxy—that meets the definition insofar as only the two communicating parties having the ability to see the cleartext. That's assuming the server has disk encryption and no employee has access to it while the disk is unlocked.
Kohler calling it E2EE is still disingenuous as fuck regardless of my above hypothetical, however.
Again, nope. Not what end to end encryption means. That's just HTTPS.
WTF?
What we're looking for is "zero-knowledge storage". If it's anything else we can just ignore the whole "encryption" marketing. That's because claiming "end-to-end encryption" is still semantically valid if it's transit only and they are the other end.
Doesn't end to end also mean at rest?
But at rest still doesn't matter as they'll own the key unless it's zero knowledge like you said.
End-to-end means a path from point A to point B.
End-to-end encryption could definitely include at rest encryption, but only as part of the path that isn't one of the ends. An example would be where a service like WhatsApp stores your message until it can be delivered to the other contact. End-to-end includes "zero knowledge storage" in this example because WhatsApp can not view your message. You are one end and your contact is the other end. The data is stored encrypted at rest (going trough their servers) because their server is neither end. This is literally why end-to-end encryption exists.
In the case of the smart toilet storage, you are not both ends. Instead you are one end and the storage provider is the other end. The transit is still end-to-end encrypted but it does not imply "zero knowledge storage". They use the term end-to-end encryption because they transfer the data to their servers without people being able to intercept it. And that's semantically correct.
Ah, that makes it clear how it may or may not include at rest.
Thanks!
it does not. end to end encryption and point to point encryption are two ways of delivering an encrypted message to a destination. a point to point encrypted message has a message and header that are decrypted by every node in the network to determine where to route it next. an end to end encrypted message has its header and body encrypted separately such that only the sender and recipient see the body, but the nodes can read the header for routing. encrytion at rest just means that the message, once saved to disk, is encrypted
What if it was AI to AI encrypted, huh?
What could they possibly tell me about my health by visually inspecting my shit? I see the website mentions detecting blood, but pretty sure I can do that too...
The colour can say a lot of different things than just showing blood in your stool.
Also, if you have red blood in your toilet after shitting, it's probably a popped hemorrhoid, but if your shit is black and tarry, that's digested blood, could be from an upper GI-bleed.
If your shit is orange/yellowish and floaty, youre clearly not absorbing fat correctly for some reason.
There's all sorts of things you can tell from shit. I've actually logged hundreds of photos of shit to an e-mail address (because I want to store them but not in my phone's gallery).
I'm waiting on going to a good gastroenterologist hopefully.
But idk if I'd trust an ai analysing them, but proper doctors should be able to.
Edit here https://gutscharity.org.uk/advice-and-information/poo-torial/
The size, shape, consistency, color are all telling of something going on.
Tie that in with tracking changes in diet and can learn a lot.
Tracking what you eat in detail is still a bitch though.
For this too, the camera is kinda helpful. Just snap a photo and the write it down later. Or don't write it down and just have the photos there and "I'm sure I'll remember when I look at it"
Would you consider spending $600 plus $7/month for this? (Assuming it was actually secure not like this one)
You asked about what they could possibly tell about your health from your excrement, not what my monthly budget is...
No, I know. I didn't see any possible market for a product like this, but you shared you're already doing what this product does, but manually. So I was wondering how much value you see here.
I imagine a lot more people would benefit from passive monitoring of poop than just I.
I pretty much figured out my issue and now I've just been documenting it because the doctors genuinely believe the opposite of whatever I tell them, so I have to have photographic evidence and even that doesn't usually help. (Finnish healthcare sucks. Is the price bad? No, it's free. Does it achieve anything? Also no. Especially when it comes to mental health.
it can read your future… it’s kinda like tea leaves, but shittier
I read pool leaves. I stand on your roof and tell you your future.
Wait... this is a thing? I never thought someone would actually make this when it's been the butt of many gags in the media.
This is straight from The Onion
https://www.youtube.com/watch?v=DJklHwoYgBQ
Crazy it took this much scrolling for me to see a reference to Smart Pipe
When the Man-in-the-middle hacks into it, he may not like what he sees.
I'm shocked. Absolutely shocked, I tell you.
I too am shocked at this obvious betrayal of water closet privacy. That nobody and I mean nobody could have seen coming.
It's like you have to be Nostradamus just to avoid getting ripped off nowadays.....