Broken Browser Support for Video Surveillance

By: Ethan Ace, Published on Mar 22, 2017

Modern web browsers have left the security industry behind. Current Chrome, Firefox, and Microsoft Edge browsers do not support NPAPI plugins, crippling live video and configuration in many IP camera and recorder web interfaces. And despite years of warnings that these plugins would be (or have been) disabled, few manufacturers have released plugin-free UIs with support for H.264 streaming.

In this report we look at what manufacturers are affected and which have released plugin-free web UIs, covering:

  • Arecont
  • Avigilon
  • Axis
  • Bosch
  • Dahua
  • Hanwha
  • Hikvision
  • Panasonic
  • Pelco

****** *** ******** **** left *** ******** ******** behind. ******* ******, *******, and ********* **** ******** do *** ******* ***** plugins, ********* **** ***** and ************* ** **** IP ****** *** ******** web **********. *** ******* years ** ******** **** these ******* ***** ** (or **** ****) ********, few ************* **** ******** plugin-free *** **** ******* *** H.264 *********.

** **** ****** ** look ** **** ************* are ******** *** ***** have ******** ******-**** *** UIs, ********:

  • *******
  • ********
  • ****
  • *****
  • *****
  • ******
  • *********
  • *********
  • *****

[***************]

Browser *******

**** ***** ********** ****** ******* ***** (or ***** ***):

******* ** ****, ***** are *********** ***** ***** Internet ********, ******* *** age,******** ******** *****, *** **** ** feature *******. 

Plugin-Free *** ********** 

***** *** ***** ******* plugin-free web ********** ***** ***** H.264 ******* (****** ******* MJPEG, ********* *****).

  • **** (********* **** *********, others ***** ** ****)
  • ***** 
  • ******

***** *** ******* ***** manufacturers ***** ** *** require *******, ***** ***** streaming ** *** *******, including ********, *******, *********, and *****. ** **** not ******** ***** ****, focusing **** ** ***** offering *.***/*.*** ******* *******.

Axis *** *** ********* 

**** *** ********* *** *** ************** ******** ****** **** H.264 ** ***** *** cost********* ****. *******, **** **** Axis ******* **** *** yet ******** **** ******. Axis **** **** **** is ********* *** ******* in ** ******* *** rest ** **** *** other ******.

Bosch: ** ****** *.***

** ******* *********, *.*** streams ******* ***** ******* in *** ********. *** example, *** ***** ***** shows *** ********* ********* ***** ** *******.

  

Hanwha / *******

*** ****** ****** (******* P, *, *** *) ship **** ***** ******* *** interface, ***** **** ******* includes ***** ******* *******, working ** *** *** browsers, ***** *** **** Samsung ******* ********* ******** ActiveX *** **** **** viewing *** *************. **** **** this *** ********* ** also ********** (***** *****), and ****** ** ****** phone ******** ** **** as *** (***** ********* only).

Plugins ******** 

*****, ** ****** ******* manufacturers ***** ******* ******* for *********, ******* **** streaming ** *************, *********:

  • **** (******* *** *********)
  • *****
  • ********* 

Axis: ***** **** / ******* *************

** ******** ***** **** IE (***** *** **** Media ******* ******), **** cameras ******* ***** ***** only. ********* *** *.*** stream ******* ***** **** the ******* ** *** supported: 

************, ************* ** **** elements ** ******** **** not ***** **, *********** below.

Dahua: No **** ***** / ******* *************

** ******** ***** **** Internet ********, ***** ***** ** live *****, ***** **** in *******:

 

**** **** ******* ***** setup, **** ** ***, shown *****. ******* ******* installed, ***** ****** **** VMD ******* ** ******* masks.

Hikvision: ** **** ***** / ******* *************

**** *****, **** ***** and **** ************* ******** are **** ******** ******* ******* (ActiveX ** **). **** that ********* ******** * ********* ** 2015 ********* ****** *******, ******** ** ***** be **-******* ** "** 2015", *** **** *** *** occurred.

*****, ******* **** ***** displayed, *** *** ********* configuration *** ********, ***** here ** *******.

H.264 / *.*** ********* ********

** ********* ** *** ****** ****** ************ ******* Support ******, ***** *** **** to ****** *.*** (*** now *.***) ***** ******* NPAPI *******, **** **:

  • ***** ***** ********.******** ********************* * **** ***** platform ******* **************. **** *********** *** cases *** ** ******** using ********** (*** ******* ***** out ******** ** ****** **********).

  • ******.********* ******** *** **** time ************* ******* ***** and *** ********** *** also ** **** *** applications **** **** ********* media *** ****. ******’*********** ********** ****** ** ****** HD ***** ******* * browser *** **.

*******, ***** *** **** limited ******** **** ** the *** ***** ***** Chrome, *** **** ******* web *******, ******** ***** support, ** ******* ** be **** **** *** surveillance ******** ** ***** will ******* ***** ********.

 

 

Comments (30)

Undisclosed Distributor #3

03/22/17 06:13pm

I would argue we're not engaged in a "Security" industry. As the last 3 years have proven, this is merely video surveillance. "Security" is just a word.

Undisclosed Integrator #1

03/23/17 02:27am

Thanks for this article and hopefully manufacturers pull their head out of the sand. This is my biggest gripe with manufacturers right now - your great products are USELESS if there is no human interface that works. Forcing people to use Internet Exploder is a good way to lose business and no solution to any problem. This problem is across the board with IOT devices, in the IT world most switches etc. which are configurable via IP at least have command line interface. I would vastly prefer this to a half a$$ed browser interface. That said I am not sure how you would tune motion detection settings etc. without a visual interface.

Undisclosed Distributor #7

In reply to Undisclosed Integrator #1 | 03/27/17 01:50pm

Use the VMS/CMS software until a fix becomes available.

Undisclosed Integrator #1

In reply to Undisclosed Distributor #7 | 03/27/17 10:03pm

That is what you do for live viewing and playback but for initial setup of IP address, DNS, NTP servers, camera side motion detection, image adjustments etc. etc. you mostly have to do it directly on a camera. Of course this is generally only a one time setup but if I am installing camera's for a living then it has a big impact. I am sure that manufacturers will eventually release plugin free UI's, would have thought that there would be more movement on this. Plugin support on browsers has been in the process of being stripped out for years now and what is it? - all of 3 manufacturers have come out with a solution...

Undisclosed Integrator #2

03/22/17 08:29pm

Dahua doesn't support chrome correctly. You can't login! You have to use IE / Edge or firefox..

Undisclosed Distributor #3

In reply to Undisclosed Integrator #2 | 03/23/17 05:02am

They're all this way because waaaay back around the turn of the new millennium out of the primordial linux swamp came BusyBox! The OS that all of the major Chinese manufactured DVR/NVR operating systems were built on top of. They all suffer from the same limitations, and they all have basically the same features. Give evolution some time and more than the GUIs will have changed, hopefully.

Undisclosed Integrator #4

03/23/17 05:08am

I had a bit of fun getting March Networks working across a corporate network when I needed IT involvement many times in getting Silverlight onto client machines

Avatar

Campbell Chang

03/23/17 08:21am

I have a Dahua camera here that now uses a Chrome app.  

 

Web Service/Easy Viewer

 

Edit:  Details here.

 

Double Edit:  In case anyone didn't know, Win 10 still has IE installed although it's not easily found.  Simplest way is Windows Key + R to bring up the "Run" window and then just type in "iexplore"

Avatar

Paul Curran

In reply to Campbell Chang | 03/23/17 09:49pm

You can also access in edge by choosing "Open with Internet Explorer"

Lee Brown

03/23/17 08:38am

Delighted to see this topic given more attention.

ActiveX, is among other things, just an easy way of extending your Visual Studio authored VMS code into a device. Who would ever want to connect with a browser that is not IE or use an OS that’s not Windows? Seems strange that a lot of camera products expose a feature rich ReSTful API and then stop short of creating a browser agnostic, video capable interface.

Along the same lines I would love to see an article identifying which popular VMS offerings are not primarily authored in a Visual Studio IDE. Seems to me that there is a strong correlation with products having cross platform functionality and innovation in both the UI and in integration possibilities.

 

Avatar

Christopher Uiterwyk

IPConfigure | In reply to Lee Brown | 03/23/17 09:02am

IPConfigure Orchid VMS: primarily C++ and JavaScript, not one ounce of C#.  Lightweight with 0 operating systems dependencies (Linux or Windows).

 

http://www.ipconfigure.com/products/orchid

Lee Brown

In reply to Christopher Uiterwyk | 03/23/17 10:56am

Thanks Christopher. Glad to add another to the list. Can you divulge how Orchid is addressing browser functionality ? WebRTC - HTML5- DASH etc ?

Avatar

Christopher Uiterwyk

IPConfigure | In reply to Lee Brown | 03/23/17 09:35pm

Orchid currently offers real-time transcoding to JPG for mobile & Chrome/Safari, and a plug-in for IE or Firefox ESR.  We will release support for WebRTC leveraging the Websocket protocol to replace the plug-in this summer.

Undisclosed Manufacturer #5

03/23/17 09:02am

**Hanwha employee**

Great article and thanks for bringing attention to an important topic that has been shrugged off for many years.  So often it is a nightmare just trying to get a customer's camera to stream video to then be able to start troubleshooting.  Plug in free UI is a huge game changer that is many years overdue for this industry.

One quick note.

The latest Hanwha cameras (X series, not sure about P, Q) can also support H.264 in plugin free browsers, with limited frame rate & resolution.  I just tested viewing with a 720p profile at 10fps, and it worked in Chrome & Edge.

In browsers with the plugin, there is a button to click on to disable the plugin, if ever needed.

Without the plugin installed, you can still get to the setup page of the web UI.

Undisclosed Manufacturer #6

03/23/17 02:34pm

With a large number of Chinese developments as one can presume, it should not come across as a shock that the net results are as the current trends are subject to the development tools used.

A glance here. https://www.w3counter.com/globalstats.php gives you idea what really the development community for security should be looking at.

The main issue with at least the larger companies is their majority profit caters for domestic market, where windows XP, and Windows 7 are the main players in town!

You can see why Windows8 didn't take off either here.

https://www.extremetech.com/computing/182735-chinese-government-bans-windows-8-due-to-microsofts-retirement-of-windows-xp

So anything outside the WindowsXP & 7 had been a 2nd consideration.

I believe it is not what the developers would always agree about, engineers tend to be tech savvy and would maybe run later systems like windows10 (choke choke).

But at the end of the day deadlines, to complete! rush! and goal kick the release build to sell a few more tins of beans (AKA Cameras) out, takes their priority.

As the first comment was right, a lot of so called security lacks in many ways fundamentally what this industry now lacking. The only way to change direction is via education and making the right purchase.

 

Greg Masters

03/27/17 05:28am

At least for now, the ESR versions of firefox (32 bit versions) still have MMX plugin support for the web UI.  Tested and it works.  I am working with a developer to create a standalone viewer app which eliminates the browser entirely (windows), it would be fine for clients who just want a way to move and view their camera(s).

Get it here:  https://www.mozilla.org/en-US/firefox/organizations/all/

 

 

John Szczygiel

03/28/17 02:29am

Great to see this topic getting covered in IPVM.

At Brivo we recognize that our products must support multiple major browsers and that continuous integration of modern browsers is required to maintain functionality and security.

John Honovich

IPVM | In reply to John Szczygiel | 03/28/17 02:36am

At Brivo

John, what is Brivo doing with video streaming in their browser clients? How is the video being displayed in Chrome now?

John Szczygiel

In reply to John Honovich | 03/30/17 08:32pm

As your members are pointing out, this is a complicated area with trade-offs to be made.  Our basic strategy is to use modern components such as HTML5 players and serve video that the client (browser or app) can process.  We have to monitor browser releases very closely to ensure that changes to settings and underlying components are identified and handled within our solution. Another key element is ensuring that users are upgrading their browsers on a regular basis.

Undisclosed Manufacturer #8

03/27/17 06:50pm

There is a workaround on Chrome browser.  Just need to search for "IE Tab" in Chrome Web Store and install it.

Undisclosed Integrator #1

In reply to Undisclosed Manufacturer #8 | 03/27/17 07:21pm

Yes that works on some manufacturers UI's, Axis does work but not on others. Also using the IE tab in Chrome is painful, often when you click on a new setting you have to enter login credentials again...

Avatar

David McNeill

03/28/17 05:52pm

Have to search the office just to find a windows PC to run IE to configure Hikvision cameras.  A real nuisance. 

No reason why the straight text configure settings require any plugin at all. Very annoying.  Also makes it impossible to script.

Ryan O'Daniel

IPVMU Certified | 03/29/17 01:57am

Here's a fix for your current version of Firefox to resolve the plugin issue:

open a new browser tab in firefox
1. enter the following: about:config
2. you will be prompted with a security warning, accept
3. right click on the screen over one of the existing commands and go to "New" then select "Boolean"
4. enter the following: plugin.load_flash_only
5. accept/ok
6. set tag to "false"
7. accept/ok
8. press "shift+F2" to open command line
9. type "restart"
10. this will force firefox restart and when it comes back up you should be good to go

I've heard updates will disable this feature again but haven't had any updates to firefox yet to find out. 

 

Truman HW

03/05/18 01:23am

I believe there's a terminal command you can use to re-enable NPAPI. I know that sounds unbelievable... and I haven't ran the command yet to verify it; it MAY be per session/instance... but I'm not sure. I have a MASSIVE list of shit to get caught up on tomorrow; if I'm able. I will attempt to get the terminal line for Mac users who want access. 

Greg Masters

03/05/18 05:12am

Hello, my company has a solution to this issue.  Its a standalone windows app, which does away with the web browser entirely. Not a full-featured app like Blue Iris or the Smart PSS software,  its intended to replace the web browser for clients/users who just want to look at their cameras with minimal configuration needed or hidden menus.

Its portable, and easy on resources. For all Dahua and clone cameras/NVR's.

https://preferredsolutions.us/

John Honovich

IPVM | In reply to Greg Masters | 03/05/18 08:34am

Greg, but if a user needs to add your application, why not just install the Dahua application itself?

Greg Masters

In reply to John Honovich | 03/05/18 01:07pm

Thanks for your question!

This application was developed to address the **browser** issue of the lack of plugin support for Dahua (and OEM) cameras and NVR's.  We feel it very suited for that task, especially for clients and end users who otherwise would use a browser. It is not meant to replace full-featured, more complex software as Smart PSS or Blue Iris. 

Configuration is much more straightforward than the other apps, there are no hidden menus. While the initial config of the camera still requires a browser or Config Tool, a plugin is not needed for that task if a browser is used. Once that is completed by the user or his/her integrator, we feel our app allows the client or end user to view their camera(s) without being forced to use outdated or insecure browsers.  The app is meant for the audience we are discussing here, who are looking for options to replace the lack of browser support for security cameras/NVR's.

Feedback is welcomed!!

 

 

 

 

 

 

 

 

 

Undisclosed #9

In reply to Greg Masters | 03/05/18 05:16am

Is there a way to use other manufacturers like Hikvsion with the app at some point? 

Greg Masters

In reply to Undisclosed #9 | 03/05/18 01:31pm

If there is enough interest that could happen. Also porting to Android.  While the UI would not change, the underlying api's (from the Dahua SDK) would have to be changed to work with Hik.

 

 

 

John Honovich

IPVM | 09/21/18 08:13pm

Update: Safari 12 has now removed support for NPAPI:

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

ONVIF Video Surveillance Tutorial on Jan 29, 2019
ONVIF is well known within the surveillance industry as an interface to connect IP cameras and VMS systems. However, new users may find it...
Verkada Cloud VMS/Cameras Tested on May 02, 2019
Verkada is arguably the most ambitious video surveillance startup in many years. The company is developing their own cameras, their own VMS, their...
Salient CompleteView 20/20 VMS Tested on Feb 27, 2019
In IPVM's last test of Salient 3 years ago, we found various problems and deficiencies. Now, Salient says their new CompleteView 20/20 "unified...
Milestone XProtect 2019 R1 Tested on May 15, 2019
For the past few years, Milestone has released quarterly software updates XProtect VMS platform. What is new and how much impact do the updates...
Camera Configuration Manager Shootout - Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision on May 01, 2019
Which camera manufacturer has the best management tool? We tested 6 manufacturers - Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision to find...
IndigoVision Control Center VMS Tested on May 30, 2019
IPVM's last test of IndigoVision's VMS was in 2010, which found enterprise VMS features and a simple client interface. but no 3rd party camera...
Avigilon Blue VSaaS Tested on Aug 05, 2019
Avigilon says Blue is a "powerful integrator cloud service platform", easy to set up and configure, quickly scale business, by leveraging cloud...
Network Optix NxWitness 4.0 Tested on Oct 10, 2019
Network Optix released Nx Witness 4.0, proclaiming new features like a deep learning analytics metadata SDK, increased H.265 support, and UX...
Milestone XProtect 2019 R3 'Centralized Search' Tested on Oct 30, 2019
Milestone has had problems over the last few years releasing significant new software. Now, in XProtect 2019 R3, Milestone is touting "one search...
IP Camera Browser Support: Who's Broken / Who Works on Dec 10, 2019
For many years, IP cameras depended on ActiveX control, whose security flaws have been known for more than a decade. The good news is that this is...

Most Recent Industry Reports

Latest London Police Facial Recognition Suffers Serious Issues on Feb 24, 2020
On February 20, IPVM visited another live face rec deployment by London police, but this time the system was thwarted by technical problems and...
Masks Cause Major Facial Recognition Problems on Feb 24, 2020
Coronavirus is spurring an increase in the use of medical masks, which new IPVM test results show cause major problems for facial recognition...
Every VMS Will Become a VSaaS on Feb 21, 2020
VMS is ending. Soon every VMS will be a VSaaS. Competitive dynamics will be redrawn. What does this mean? VMS Historically...
Video Surveillance 101 Course - Last Chance on Feb 20, 2020
This is the last chance to join IPVM's first Video Surveillance 101 course, designed to help those new to the industry to quickly understand the...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see, especially because most look and feel the same. Even insecure 125 kHz...
AI/Smart Camera Tutorial on Feb 20, 2020
Cameras with video analytics, sometimes called 'Smart' camera or 'AI' cameras, etc. are one of the most promising growth areas of video...
China Manufacturer Suffers Coronavirus Scare on Feb 20, 2020
Uniview suffered a significant health scare last week after one of its employees reported a fever and initially tested positive for coronavirus....
Cheap Camera Problems at Night on Feb 19, 2020
Cheap cameras generally have problems at night, despite the common perception that integrated IR makes cameras mostly the same, according to new...
Milestone Launches Multiple Cloud Solutions on Feb 18, 2020
Milestone is going to the cloud, becoming one of the last prominent VMSes to do so. Milestone is clearly late but how competitive do these new...
Video Surveillance Architecture 101 on Feb 18, 2020
Video surveillance can be designed and deployed in a number of ways. This 101 examines the most common options and architectures used in...

What IPVM Is

The world's leading authority on video surveillance, with 200,000+ visits monthly.

  • Articles on cameras, video analytics, VMS, and trends
  • Tests showing actual performance and problems
  • Courses in surveillance, access control, etc
  • Camera Calculator for designing systems

Dedicated To Independence

We're dedicated to staying independent and objective. We're the only industry source to refuse any and all advertisements, sponsorship, and consulting from manufacturers. Why?