Google Breaks Surveillance Browser Support

Published Sep 09, 2015 04:00 AM

Now you have a choice.

Broken video surveillance web browser support or an insecure, prone to crashing interface.

As Google has been warning for ~2 years, Chrome has now discontinued NPAPI support. Amazingly many video surveillance manufacturers have been impacted by this, some severely

Inside, we share our test results on which browser implementations still work and to what extent, covering Axis, Avigilon, Bosch, Dahua, Hikvision, Samsung, Exacq, Genetec and Milestone.

History

For those unfamiliar, the Netscape Plugin Application Programming Interface was introduced in the 90s, effectively the first standard method for creating browser plugins, most commonly used for audio and video streaming.

Chromium's plans to remove NPAPI support were first announced in September of 2013, citing speed and security concerns:

"Today’s browsers are speedier, safer, and more capable than their ancestors. Meanwhile, NPAPI’s 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity."

In early 2014, users were notified that they were using a plugin that would soon be disabled, in an attempt to get developers to avoid NPAPI plugins.

Then, NPAPI plugins were disabled by default, forcing users to enable special settings in Chrome to continue using them.

Finally, in September 2015, in version 45 of Google Chrome, NPAPI support was totally removed.

Why This Is A Problem

Despite literally two years of warnings, many surveillance manufacturers have not updated their web interfaces to use non-NPAPI plugins, disabling some features or rendering the web interface inaccessible in Chrome.

There are three reasons this is a problem:

  1. More People Use Chrome: Recent estimates name Chrome as the most popular browser worldwide, with about 50% market share.
  2. Internet Explorer often disabled or out of date: Due to corporate IT policy, many users may not use IE at all, or it may be limited to older versions.
  3. IE development discontinued: With the release of Windows 10 and their new Edge browser, Microsoft has stopped development of new IE versions, and support will be limited to service releases only. Not that unlike IE, Edge does not support ActiveX.

Impact On Camera UIs

In general, users should expect that H.264 video will no longer work in Chrome. We checked cameras from Axis, Panasonic, Sony, Dahua, Hikvision, Avigilon, and Bosch and none supported H.264 streaming using Chrome.

This list overviews Chrome support in version 45:

  • Avigilon: No change. MJPEG streaming only.
  • Axis: H.264 streaming now unavailable. MJPEG streaming only.
  • Bosch: No change. MJPEG streaming only.
  • Dahua: Live video and VMD config now unavailable in web interface using Chrome.
  • Hikvision: No live video, event config, or firmware upgrades available in Chrome 45+.
  • Panasonic: No change. MJPEG streaming only. Config requires Internet Explorer.
  • Samsung: Web interface now completely unavailable.
  • Sony: No change. MJPEG streaming only.

We discuss each in more detail below, sorted from most to least affected by Chrome's removal of NPAPI support:

Severe: Dahua

In Dahua cameras, no live video is displayed and users may not configure motion detection. Other settings may be changed.

IPVM Image

In Dahua (and OEM, such as the Honeywell NVR below) DVRs/NVRs, users may not log into the web interface at all:

IPVM Image

Severe: Hikvision

No live video is available in Hikvision using Chrome. Additionally, some features such as event configuration and even firmware updates do not work. Users must use IE with an installed plugin for proper use.

According to a statement released by Hikvision, Chrome support will be re-enabled in upcoming firmware releases, schedule for Q4 2015.

Because Hikvision is committed to providing safe and effective solutions to our customers, we are working to update the firmware for our products so they will be compatible with Chrome going forward. This solution, which will require a firmware upgrade on DVRs, NVRs, and IP cameras, will be rolled out as outlined below. During this transition period, our products will continue to operate with other browsers such as Internet Explorer, Safari, and Firefox.

Severe: Samsung

Samsung cameras inform the user that the Webviewer plugin is not installed, despite it actually being installed. Even after rerunning installation, the same message is presented. There is no way to access the web interface without the plugin installed, forcing users to use IE.

Moderate: Axis

Chrome users are now unable to view H.264 video. MJPEG may still be used. Note that Axis has always required Internet Explorer for some configuration (motion detection, camera applications, etc.).

No Impact: Multiple

Several manufacturers' web UIs are not impacted by NPAPI's removal, as they use only MJPEG for video or have never worked in Chrome:

  • Avigilon: Avigilon's camera UI is unchanged in Chrome 45, as it only uses MJPEG for live video, not H.264.
  • Bosch: H.264 video is unavailable in Chrome, as it requires an ActiveX plugin. MJPEG streaming works in Chrome without plugins.
  • Panasonic: Panasonic does not support H.264 video or camera configuration in Chrome. MJPEG video is supported.
  • Sony: Sony does not support live H.264 video in Chrome. MJPEG is supported. Users must use IE to configure events.

VMS Web Client Impact

In addition to camera UIs, NPAPI support may impact VMS web clients, though multiple VMS developers we spoke to and tested tell us that they have already transitioned away from NPAPI plugins for web client use. Just two examples:

Exacq

Exacq's web client works properly in Chrome version 45, requiring no plugins.

IPVM Image

Genetec

The Genetec Security Center web client works properly in Chrome with no plugins required, since MJPEG is used for streaming video. However, Genetec's Server Admin (used to activate and change licenses, perform MS SQL config, and other low-level admin tasks) uses Microsoft Silverlight, which is no longer supported by Chrome. This image was taken on a machine with Silverlight installed:

IPVM Image

Milestone

Like Genetec, Milestone uses MJPEG for web client streaming, requiring no plugins. The Milestone Mobile web client works as expected in Chrome version 45.

IPVM Image

H.264 Streaming

It is possible to stream H.264 video without NPAPI plugins. As Google describes in its NPAPI deprecation guide, they include:

  • HTML5 Media Elements. The HTML5 Specification provides a rich media platform through the <audio> and <video> elements. More complicated use cases can be achieved using the <canvas> element (for example check out the Video FX Chrome Experiment).

  • WebRTC. WebRTC was designed for real time communication between peers and the technology can also be used for applications like live streaming media and data. Google’s Chromecast device uses WebRTC to stream HD video between a browser and TV.

When or whether video surveillance developers broadly support these remains to be seen.

Comments are shown for subscribers only. Login or Join