It's November! C'mon tplink!

[PetePeter]

I'm eagerly waiting to see if TPLink releases the new fw where things work again.
cmon tplink dont let me down - anymore.

[ddonevski]

The integration author informed us in his last post (late September) that TP LINK stated they were working on new app version that would support the integration. Although they didn't state which app explicitly, I think they meant the cloud app running on their cloud servers. They stated that they expect to launch it by mid November. However, earlier they stated that they would develop the endpoint specifically for this integration and then they didn't. Neither have they explained why. The integration author asked them 5 questions regarding the latest solution they promised to make, and as far as we know, never received an answer. So far they tended not to keep promises and leave things unclear so I'm not very optimistic about this. I hope I'm wrong.

[ddonevski]

But they did say that they expected to release the new app which will support this integration by mid November and as any project, this app may be finished a bit later than expected. We'll see by the end of year.

[andipilz]

Dear all and @JurajNyiri,
my C220 informed me yesterday late evening (CET) via my iOS app that a new firmware eis available. I had not yet the time to check whether this is a time-valid statement or just a general remark, as the camera is on the old software of late 2023 since it is downgraded.
Is it worth trying? Otherwise I downgrade it again, as this firmware is still on a micro SD...

[PetePeter]

Mine hasnt yet received the update. I have 2x C200s that had not been downgraded yet. One a v1 the other a v3. The guy above said that the update isnt working for him either. Maybe some work has to be done by the creator of this integration to work with the new fw. idk.
between this and my smart switches dying once per year, i'm losing faith in tplink

[TeDeVPrime]

this is tp-link we are talking about. when did you start having faith for a company who releases unmanaged switches with V1, V2, V2.5, V3, V4....

it's a switch.... how many times can you do it wrong?

Tp-link cries over the fact that this integration is not "secure" for their cloud.....
if it is not they should have fixed it since day one.

[PetePeter]

i meant smart plug. but yeah, it's literally just a smart plug, why ship me crap tplink?! Their Kasa ones were bulletproof. the P100 ? not so much the P110? not so much.

even with their tapo camera fw. the fw before whatever theyre releasing now turns my v1.0 into a useless mess, go back a few version, stable .

[AndyRockall]

I just updated two of my C210 cameras to the new version 1.4.3 firmware and can now use them with integration again.
All functions seem to be working OK.
Just waiting for the other cameras to get the update!

[AndyRockall]

I got excited too quickly!!!
One more camera got the upgrade and the error is back on this camera and one that was working with ver. 1.4.3
Back to the drawing board I guess

[ddonevski]

Although the main thread is titled "Invalid cloud password on firmware build 230921 and higher", I don't think this error is caused by firmware because there is post where user reported downgrading to firmware v. 1.3.6. and still receiving the cloud password error message. I may be wrong, but I think Tapo fixed a security issue which allowed 3rd party apps to extract security tokens from their cloud. They fixed it at some point so cams which had previously extracted the token continued to work up to the point when they received the new firmware and needed to extract the token again, which they couldn't anymore with new cloud security patch applied. I think this because, from the user experiences reported in threads on this repo, it appears that people got their cams to work with both older and newer firmware versions provided that they blocked internet access to their cams. Which doesn't make sense if extraction of security token is required.. I really don't know how this works. Ayway, it appears people only got their cams working by blocking internet access, regardless of firmware version.
Tapo stated that they would fix this issue in new app (not firmware) version. But they never answered the integration author's questions on the details on how this would work and whether some adjustments are required on the integration side to make this work.

[ddonevski]

Took a look at the pytapo library which is used by this integration. In the readme, there is "Authentication" section in which the author states that depending on the camera model and firmware version, authentication can be performed either locally using the cam account credentials or via the cloud. It appears that some older firmware allowed local authentication. Newer firmware required cloud authentication which worked up to the point when Tapo patched their cloud. If I understood correctly. But in that case, I don't get how people got their cams working with new firmware versions and blocked internet access.

[JurajNyiri]

@ddonevski

Although the main thread is titled "Invalid cloud password on firmware build 230921 and higher", I don't think this error is caused by firmware because there is post where user reported downgrading to firmware v. 1.3.6. and still receiving the cloud password error message.

Versioning for cameras is different per models, it usually happens on cameras with BUILD 230921 and higher, not firmware version. This information was also crowdsourced so it might not be 100% correct. But it is based on firmware as far as we know. It most probably also requires interaction with cloud to get the new token for camera control authentication.

I may be wrong, but I think Tapo fixed a security issue which allowed 3rd party apps to extract security tokens from their cloud.

This never happened and never happens in publicly released pytapo version. I have a version which fixes this issue completely, but tplink has forbidden me to release it. It has been only shared with tplink via private email conversation.

They fixed it at some point so cams which had previously extracted the token continued to work up to the point when they received the new firmware and needed to extract the token again, which they couldn't anymore with new cloud security patch applied.

Incorrect. They changed the local authentication so that it no longer uses cloud password as a base, instead it uses a random token issued from cloud. Cloud stuff still works the same way today (again - to prevent confusion - this never happens on publicly released pytapo version, the functionality is not there).

it appears that people got their cams to work with both older and newer firmware versions provided that they blocked internet access to their cams. Which doesn't make sense if extraction of security token is required.

It works, camera cannot get the cloud issued token, falls back to using admin password == cloud account password as base.

Tapo stated that they would fix this issue in new app (not firmware) version.

They did not really specify whether it would be an app, or firmware. They only said a date and that it would "start to work". My follow up questions, as well as reminder I sent a couple of days ago never got answered so far.

Took a look at the pytapo library which is used by this integration. In the readme, there is "Authentication" section in which the author states that depending on the camera model and firmware version, authentication can be performed either locally using the cam account credentials or via the cloud.

Incorrect. It states:

Depending on your camera model and firmware version, the authentication method varies.

Normally you should be able to authenticate using the "camera account" created via the Tapo App (Settings > Advanced settings > Camera account).

In case of a similar stack trace:

...

Attempt to authenticate using admin as user and your TP-Link cloud account password as password.

Now this is still true. Before autumn 2023, cameras either used "admin" account, or "3rd party account" for control (the one you set up for onvif). Both of these accounts are completely local to camera and have nothing to do with cloud, network wise. "admin" uses your email cloud password as a base, "3rd party" uses whatever you put in for onvif control. Most of the cameras / firmwares after around year 2022 need admin account for control. After Autumn 2023, on supported firmwares and possibly apps, it replaces cloud password with a random token from cloud, resulting into this issue. (Ironically, because of CVE I raised with them and they still did not allow me to publish it publicly).

It appears that some older firmware allowed local authentication. Newer firmware required cloud authentication which worked up to the point when Tapo patched their cloud.

Incorrect, as stated above, public pytapo never interacts with cloud.

[ddonevski]

@JurajNyiri Thanks for detailed explanations. With various user claims scattered throughout threads, and without sufficient techical knowledge how the integration works, it is hard to understand what exactly caused the issue and what is the expexted solution. As a regular user, I wasn't able to understand this so thanks for clarifications 👍🏻

[JurajNyiri]

Here is the latest:

• They told me they will get me an accurate answer as soon as possible, at 2024-09-24 to my questions about how the solution will work like after they forbidden me to release a new version of pytapo I have had ready since early 2024.
• I sent following questions on 2024-11-12;

• Please see my questions in the email sent on 20. 9. 2024.
• In the email from the same date, you stated "We expect this feature to be completed and launched by mid-November.". Are there any new updates on when users can expect to be able to use integration again and by what means?
• When can I publish the CVE?

no answer as per today.

[JurajNyiri]

@signaleleven you got it right. For users who are not that familiar with network and downgrading firmware it is a lot harder to onboard to this integration and its just additional hoops they have to jump through to get it to work which is not user friendly --- and they lose cloud features (if they want them) and keeping old firmware represents a risk of missing out new features and (security) fixes.

[TeDeVPrime]

or we can throw away the tp-link cameras.
every single thing that i had which is Tapo.... stopped working through the years or i needed to do some ninja shit to make it work again.

[signaleleven]

@TeDeVPrime Fair, but give me a shout if you have a camera this cheap with semi-official local only management like this. I'm legit impressed by the fact that the setup can complete while cut off from the internet...and the official app still works (with a warning that it works only locally).
(didn't mean to turn this into a pro/con thread, sorry)

[TeDeVPrime]

the price is the ONLY thing that it is keeping this interesting and alive.
personally i just moved on to UniFi and all my problems were solved. yes i know that we are talking about an investment but my network was already based on UniFi, so it wasn't that bad. especially if you consider that the Turret costs less than 90 euros which is like 50 euros more than the tp-link?

[signaleleven]

Yes, but with UniFi it's not just the price of the single camera, you're buying into an excellent ecosystem that comes with a premium price (deserved, I guess) not just for the cameras. Can you use their cameras without their switches and APs?
All I wanted to say is that TAPO is impressively cheap for the degree of local independence they offer. They are barely decent, in absolute sense, but compared with the rest in their price class, I was impressed. I'm tired of fighting to turn cloud-only devices to be local only. This offers such little resistance... I guess I am easily impressed :)

[ddonevski]

@signaleleven Regarding the reasons one might wish to be able to use the official app, here's my reason. I run HA and Frigate on Orange Pi 5B for surveillance in my country house which is around 70 kilometers away and which I don't really visit this time of year. Orange Pi boards and known to freeze if the adapter doesn't provide sufficient current. Power outages are quite common in the village where my house is situated. This usually results in powering the board off and then it just boots back up once the power is back and everything works fine. Once the power outage lasted just the right amount of time to throw my board in limbo and I lost all control. The good thing was I still had the official app so while not being able to enjoy the advantages of HA and its integrations, I could at least check the cams through the official app.

[JurajNyiri]

Just an idea unrelated to this topic - throw in a cheap cloud remote switch to be able to turn on / off power to orangepi. That way you can remotely reset HA if anything happens and you do not need HA to do it.

[signaleleven]

Just to be clear, I wasn't arguing that there is no good reason for wanting the cloud functionalities. That one seems valid (@JurajNyiri workaround too, in this specific case, but I can imagine a scenario where somebody needs reliable access to a camera while you consider Home Assistant an experimental system that can go down while you work on it...so I totally get the use case!)

[ddonevski]

Thanks for the tip, I'll probably do that. I just haven't been that motivated since this isn't a highly likely event and it only happened once. But now that you suggested this solution, being able to bring HA back up is very appealing. Thanks!

[fred777]

I just got a C211 with fw 1.3.11 only to realize that it's not working. After some more reading I ended up here and kindly want to ask if this error is somehow related:

Unsupported encryption scheme 192.168.10.55 of type {'device_family': 'SMART.IPCAMERA', 'encryption_type': 'AES', 'https': True}: 
{'error_code': 0, 'result': {'device_id': '!!!!!!!!TOP!SECRET!!!!!!!!!!!', 'device_name': 'Tapo_C211_886C', 'device_type': 
'SMART.IPCAMERA', 'device_model': 'C211', 'ip': '192.168.10.55', 'mac': 'CA-FE-BA-BE-AF-FE', 'hardware_version': '2.0', 
'firmware_version': '1.3.11 Build 240427 Rel.61418n(4555)', 'factory_default': False, 'is_support_iot_cloud': True, 
'mgt_encrypt_schm': {'is_support_https': True}, 'encrypt_type': ['3'], 'encrypt_info': {'sym_schm': 'AES', 'key': 

I'm getting it when I try to add the camera by IP address in Home Assistant 2024.11.3

Tried factory reset + internet blocking - didn't work.

[JurajNyiri]

This error is not coming from this integration. It will work via this integration.

[fred777]

Ok, sorry - my bad - I have confused "Tapo: Cameras Control" integration from HACS with TP-Link SmartHome/Camera integration bundled already with HA 🙈

You integration works! Thanks a lot!

[JurajNyiri]

I received a great update from TPLink today.

• They cancelled the cloud endpoint they mentioned earlier.
• There will be a new toggle in the app, that will allow you to set camera to be controllable via this integration (and other 3rd party solutions). This will be fully local.
• There will be no new firmware as this will be implemented via the app.
• It will require no changes to this integration.

It will be released on Dec 13, 2024, in Tapo 3.8.1.

[wehrmannit]

So... they lost heaps of customers (like me) because they tried to do something on their own, failed and then just reverted back...

[AndyRockall]

I presume this means we can update the cameras after the App update?

[JurajNyiri]

Yes

[AndyRockall]

Brilliant thank you.
You're a star.
Your integration is great!!!!!
I hope the guys at HA will let you put it in the App store after all your work.

[PetePeter]

yay maybe they'll release an api spec as well. now that they're being friendly instead of hostile

[atle85]

3.8.103 released now in IOS App store, however I can't see any new options?

EDIT: My bad, the option is available not under each camera, but under you general profile section, as located by @wehrmannit

[JurajNyiri]

I am verifying the solution and will be releasing an update to integration with new instructions and readme updates soon.

[AndyRockall]

It's not available on Google play store yet, but hopefully won't be too long.
My wife won't let me install it on her iPad!!!!!!

[adamzeis]

I have the update and enabled the setting through Tapo Labs on iOS, but still having issues adding any of my cameras back unfortunately. Seemingly the same password issues as before.

[JurajNyiri]

It might take a while, if you need it now, factory reset and readd camera.

[ALotOfKirbys]

Well i got my 2 cameras to work now...I didnt do a hard reset on the cameras,

1 of the cameras i changed the password on it and it worked fine and started streaming on my phone.

1 of the cameras i had to delete it off my home app and then just readded it and it worked perfectly now.

[adamzeis]

Is anyone having issues with C120s? I can get all my C100s to add fine, but my C120 all say the IP address is not a supported Taco device.

[atle85]

@JurajNyiri Thanks again for the great effort. Everything is working great. But this raises a question for me. Let's say Tapo decided to shut down all of their operations as well as their servers. Do the setup or communication require to communicate with their servers? Or is it 100% local? The need for the cloud password, is what's worrying me..

Also, just wondering. Is the communication a "Tapo-extension" of the ONVIF protocol? Or is it an extra proprietary protocol?

[JurajNyiri]

Everything is 100% local. If TPLink bricks this in future with firmware update (highly unlikely, imo), we can rollback to old firmware or find workarounds again.

Cloud pwd is used for control, has nothing to do with cloud itself (notice how there is no email requirement in integration), expect, well, being a password that you have for your account with TPLink.

The integration states that while set up as well -> https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/blob/main/custom_components/tapo_control/translations/en.json#L17

[ddonevski]

If someone hasn't seen the info in another thread, I'm just letting the participants in this thread know that the Android version was released in Play Store.