EFF says Ring’s new encryption still depends on trust in the company

The Electronic Frontier Foundation published a technical assessment of TAKE, Ring’s new video encryption default, on Friday, September 11. The digital rights group calls the change an improvement over Ring’s current default protection, but argues that it remains well short of end-to-end encryption because company services still receive keys and process recordings for limited periods.

Ring announced Throw Away the Key Encryption, or TAKE, on August 26. The gradual rollout began in September, and the architecture is expected to become the worldwide default when deployment is complete. End-to-end encryption will remain available on compatible devices. The central idea is to preserve cloud features while reducing how long the company can open a recording.

How TAKE manages encryption keys

Under the previous default, videos were already encrypted in transit and at rest, but Ring services could decrypt them to perform features selected by the customer. With TAKE, each camera uses content keys that rotate every five minutes. A copy is temporarily managed by a service running inside AWS Nitro Enclaves, isolated environments that Ring says restrict access through technical controls and provide no persistent storage.

The company’s technical paper defines a rolling 24-hour window. As each key moves beyond that limit, Ring says it deletes the material required to reconstruct it and keeps no backups. If a customer plays an older video or activates a feature that requires fresh processing, the app sends the corresponding key for that session. Ring says this delivery occurs only after a user action and that its cloud cannot request the key on its own.

Implementation differs across hardware generations. Newer compatible cameras encrypt video before it leaves the device and allow customers to choose between TAKE and end-to-end encryption. Older models encrypt content when it reaches Ring’s infrastructure and support TAKE only. The change is available to customers with supported devices regardless of subscription status, although feature availability varies during the rollout.

Why the EFF considers the protection incomplete

The EFF acknowledges that deleting key copies limits Ring’s lasting access to a customer’s video history. Its criticism is that cloud services receive the necessary keys during the first 24 hours and work with decrypted video in memory. For older recordings, a customer action can provide a key again. In the group’s assessment, that architecture still requires trust in software and operational practices controlled by the company itself.

The distinction matters because end-to-end encryption keeps the keys only on authorized devices. In that mode, Ring stores encrypted video but cannot open it, even temporarily. The trade-off is the loss of Shared Users and functions that depend on remote processing, including video search and descriptions. TAKE preserves more convenience; end-to-end encryption more sharply minimizes provider access.

Law enforcement demands and external verification

In a response to the EFF, Ring said TAKE is designed so that the company cannot provide keys or decrypted content and would supply only encrypted files in response to valid legal process. The group is not alleging that Ring already retains such material. Its argument is prospective: because Ring controls the code and temporarily receives keys, a legal order could try to compel a change that preserves keys or future video. According to the EFF, the company did not directly answer that scenario.

Ring also said critical components received independent security testing before launch and that it is exploring options for further outside review. The EFF is calling for a broader audit of the infrastructure. Until additional public verification is available, the practical conclusion is less absolute than either position may suggest: TAKE reduces exposure compared with Ring’s previous default, but it does not remove the trust placed in the provider. For customers who prefer the strongest technical separation and accept losing cloud functions, end-to-end encryption remains the more restrictive option.