Broken Browser Support for Video Surveillance

Modern web browsers have left the security industry behind. Current Chrome, Firefox, and Microsoft Edge browsers do not support NPAPI plugins, crippling live video and configuration in many IP camera and recorder web interfaces. And despite years of warnings that these plugins would be (or have been) disabled, few manufacturers have released plugin-free UIs with support for H.264 streaming.

In this report we look at what manufacturers are affected and which have released plugin-free web UIs, covering:

• Arecont
• Avigilon
• Axis
• Bosch
• Dahua
• Hanwha
• Hikvision
• Panasonic
• Pelco

Browser Support

Most major browsers no longer support NPAPI (or never did):

• Google Chrome: Chrome removed support for NPAPI plugins in 2015 (see Google Breaks Surveillance Browser Support)
• Firefox: Firefox has removed support for all NPAPI plugins in its latest update (version 52.0.1)
• Microsoft Edge: Microsoft's Edge, intended to replace Internet Explorer, has never supported NPAPI plugins since release
• Safari: As of March 2017, Safari still supports NPAPI plugins, though Apple has plans to remove support in the near future, and many/most plugins do not work on iOS regardless.

Because of this, users are essentially stuck using Internet Explorer, despite its age, historic security flaws, and lack of feature updates. 

Plugin-Free Web Interfaces 

There are three notable plugin-free web interfaces which offer H.264 support (others support MJPEG, discussed below).

• Axis (Companion line currently, others later in 2017)
• Bosch 
• Hanwha

There are several other manufacturers which do not require plugins, using MJPEG streaming in the browser, including Avigilon, Arecont, Panasonic, and Pelco. We have not included these here, focusing only on those offering H.264/H.265 without plugins.

Axis New Web Interface 

Axis has released a new web interface which provides plugin free H.264 in their low cost Companion line. However, main line Axis cameras have not yet received this update. Axis says that this is scheduled for release in Q2 through the rest of 2017 for other models.

Bosch: No Plugin H.264

In current firmwares, H.264 streams without using plugins in all browsers. For example, the image below shows the Flexidome Starlight 1080p in Firefox.

  

Hanwha / Samsung

New Hanwha models (Wisenet P, Q, and X) ship with their updated web interface, which most notably includes cross browser support, working in all web browsers, while the past Samsung Wisenet interface required ActiveX for both live viewing and configuration. Note that this web interface is also responsive (shown below), and usable on mobile phone browsers as well as PCs (MJPEG streaming only).

Plugins Required 

Below, we detail several manufacturers which require plugins for operation, whether live streaming or configuration, including:

• Axis (Current web interface)
• Dahua
• Hikvision 

Axis: MJPEG Only / Limited Configuration

In browsers other than IE (using the Axis Media Control plugin), Axis cameras display MJPEG video only. Selecting the H.264 stream informs users that the browser is not supported: 

Additionally, configuration of some elements is disabled when not using IE, highlighted below.

Dahua: No Live Video / Limited Configuration

In browsers other than Internet Explorer, Dahua shows no live video, shown here in Firefox:

 

This also impacts event setup, such as VMD, shown below. Without plugins installed, users cannot draw VMD regions or privacy masks.

Hikvision: No Live Video / Limited Configuration

Like Dahua, live video and some configuration features are also disabled without plugins (ActiveX in IE). Note that Hikvision released a statement in 2015 regarding Chrome support, claiming it would be re-enabled in "Q4 2015", but this has not occurred.

Again, without live video displayed, VMD and analytics configuration are disabled, shown here in Firefox.

H.264 / H.265 Streaming Possible

As discussed in our Google Breaks Surveillance Browser Support report, there are ways to stream H.264 (and now H.265) video without NPAPI plugins, such as:

• HTML5 Media Elements. The HTML5 Specification provides a rich media platform through the <audio> and <video> elements. More complicated use cases can be achieved using the <canvas> element (for example check out the Video FX Chrome Experiment).

• WebRTC. WebRTC was designed for real time communication between peers and the technology can also be used for applications like live streaming media and data. Google’s Chromecast device uses WebRTC to stream HD video between a browser and TV.

However, given the very limited movement seen in the two years since Chrome, the most popular web browser, disabled NPAPI support, it remains to be seen when the surveillance industry at large will support these features.