Google Breaks Surveillance Browser Support

By Ethan Ace, Published Sep 09, 2015, 12:00am EDT

Now you have a choice.

Broken video surveillance web browser support or an insecure, prone to crashing interface.

As Google has been warning for ~2 years, Chrome has now discontinued NPAPI support. Amazingly many video surveillance manufacturers have been impacted by this, some severely

Inside, we share our test results on which browser implementations still work and to what extent, covering Axis, Avigilon, Bosch, Dahua, Hikvision, Samsung, Exacq, Genetec and Milestone.

History

For those unfamiliar, the Netscape Plugin Application Programming Interface was introduced in the 90s, effectively the first standard method for creating browser plugins, most commonly used for audio and video streaming.

Chromium's plans to remove NPAPI support were first announced in September of 2013, citing speed and security concerns:

"Today’s browsers are speedier, safer, and more capable than their ancestors. Meanwhile, NPAPI’s 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity."

In early 2014, users were notified that they were using a plugin that would soon be disabled, in an attempt to get developers to avoid NPAPI plugins.

Then, NPAPI plugins were disabled by default, forcing users to enable special settings in Chrome to continue using them.

Join IPVM Newsletter?

IPVM is the #1 authority in video surveillance news, in-depth tests, and training courses. Get emails, once a day, Monday to Friday.

Finally, in September 2015, in version 45 of Google Chrome, NPAPI support was totally removed.

Why This Is A Problem

Despite literally two years of warnings, many surveillance manufacturers have not updated their web interfaces to use non-NPAPI plugins, disabling some features or rendering the web interface inaccessible in Chrome.

There are three reasons this is a problem:

  1. More People Use Chrome: Recent estimates name Chrome as the most popular browser worldwide, with about 50% market share.
  2. Internet Explorer often disabled or out of date: Due to corporate IT policy, many users may not use IE at all, or it may be limited to older versions.
  3. IE development discontinued: With the release of Windows 10 and their new Edge browser, Microsoft has stopped development of new IE versions, and support will be limited to service releases only. Not that unlike IE, Edge does not support ActiveX.

Impact On Camera UIs

In general, users should expect that H.264 video will no longer work in Chrome. We checked cameras from Axis, Panasonic, Sony, Dahua, Hikvision, Avigilon, and Bosch and none supported H.264 streaming using Chrome.

This list overviews Chrome support in version 45:

  • Avigilon: No change. MJPEG streaming only.
  • Axis: H.264 streaming now unavailable. MJPEG streaming only.
  • Bosch: No change. MJPEG streaming only.
  • Dahua: Live video and VMD config now unavailable in web interface using Chrome.
  • Hikvision: No live video, event config, or firmware upgrades available in Chrome 45+.
  • Panasonic: No change. MJPEG streaming only. Config requires Internet Explorer.
  • Samsung: Web interface now completely unavailable.
  • Sony: No change. MJPEG streaming only.

We discuss each in more detail below, sorted from most to least affected by Chrome's removal of NPAPI support:

Severe: Dahua

In Dahua cameras, no live video is displayed and users may not configure motion detection. Other settings may be changed.

IPVM Image

In Dahua (and OEM, such as the Honeywell NVR below) DVRs/NVRs, users may not log into the web interface at all:

IPVM Image

Severe: Hikvision

No live video is available in Hikvision using Chrome. Additionally, some features such as event configuration and even firmware updates do not work. Users must use IE with an installed plugin for proper use.

According to a statement released by Hikvision, Chrome support will be re-enabled in upcoming firmware releases, schedule for Q4 2015.

Because Hikvision is committed to providing safe and effective solutions to our customers, we are working to update the firmware for our products so they will be compatible with Chrome going forward. This solution, which will require a firmware upgrade on DVRs, NVRs, and IP cameras, will be rolled out as outlined below. During this transition period, our products will continue to operate with other browsers such as Internet Explorer, Safari, and Firefox.

Severe: Samsung

Samsung cameras inform the user that the Webviewer plugin is not installed, despite it actually being installed. Even after rerunning installation, the same message is presented. There is no way to access the web interface without the plugin installed, forcing users to use IE.

Moderate: Axis

Chrome users are now unable to view H.264 video. MJPEG may still be used. Note that Axis has always required Internet Explorer for some configuration (motion detection, camera applications, etc.).

No Impact: Multiple

Several manufacturers' web UIs are not impacted by NPAPI's removal, as they use only MJPEG for video or have never worked in Chrome:

  • Avigilon: Avigilon's camera UI is unchanged in Chrome 45, as it only uses MJPEG for live video, not H.264.
  • Bosch: H.264 video is unavailable in Chrome, as it requires an ActiveX plugin. MJPEG streaming works in Chrome without plugins.
  • Panasonic: Panasonic does not support H.264 video or camera configuration in Chrome. MJPEG video is supported.
  • Sony: Sony does not support live H.264 video in Chrome. MJPEG is supported. Users must use IE to configure events.

VMS Web Client Impact

In addition to camera UIs, NPAPI support may impact VMS web clients, though multiple VMS developers we spoke to and tested tell us that they have already transitioned away from NPAPI plugins for web client use. Just two examples:

Exacq

Exacq's web client works properly in Chrome version 45, requiring no plugins.

IPVM Image

Genetec

The Genetec Security Center web client works properly in Chrome with no plugins required, since MJPEG is used for streaming video. However, Genetec's Server Admin (used to activate and change licenses, perform MS SQL config, and other low-level admin tasks) uses Microsoft Silverlight, which is no longer supported by Chrome. This image was taken on a machine with Silverlight installed:

IPVM Image

Milestone

Like Genetec, Milestone uses MJPEG for web client streaming, requiring no plugins. The Milestone Mobile web client works as expected in Chrome version 45.

IPVM Image

H.264 Streaming

It is possible to stream H.264 video without NPAPI plugins. As Google describes in its NPAPI deprecation guide, they include:

  • HTML5 Media Elements. The HTML5 Specification provides a rich media platform through the <audio> and <video> elements. More complicated use cases can be achieved using the <canvas> element (for example check out the Video FX Chrome Experiment).

  • WebRTC. WebRTC was designed for real time communication between peers and the technology can also be used for applications like live streaming media and data. Google’s Chromecast device uses WebRTC to stream HD video between a browser and TV.

When or whether video surveillance developers broadly support these remains to be seen.

5 reports cite this report:

IP Camera Browser Support: Who's Broken / Who Works on Dec 10, 2019
For many years, IP cameras depended on ActiveX control, whose security flaws...
Hikvision Fails To Fix Unsafe Browser Plugin on Mar 21, 2018
More than 2 years ago, Hikvision committed to resolving the use of unsafe and...
Broken Browser Support for Video Surveillance on Mar 22, 2017
Modern web browsers have left the security industry behind. Current Chrome,...
Uniview NVR Tested on Mar 02, 2017
Uniview, China's self proclaimed #3 video surveillance manufacturer behind...
33 New Products Directory - Fall 2015 on Sep 28, 2015
 New products or major tech isssues that IPVM has reported on this summer /...
Comments (35) : Subscribers only. Login. or Join.
Loading Related Reports