‘End-to-end encrypted’ smart toilet camera isn’t actually end-to-end encrypted

Earlier this year, homewares maker Kohler released a smart camera called Dekoda that attaches to your toilet bowl, photographs it, and analyzes the images to advise you on your gut health.

Anticipating privacy fears, Kohler said on her website that Dekoda’s sensors only look down the toilet and claimed that all data is secured with “end-to-end encryption”.

However, the company’s use of the phrase “end-to-end encryption” is a mistake, says security researcher Simon Fondrie-Teitler highlighted in a blog post on Tuesday.

Reading Kohler privacy policyit’s clear the company is referring to the type of encryption that protects data as it travels over the internet, known as TLS encryption — the same that powers HTTPS websites.

Using the right terms matters, especially in the context of user privacy concerns. Using the term end-to-end encryption – widely adopted by messaging apps such as iMessage, Signal and WhatsApp – to describe TLS encryption is incorrect and may confuse users who see this term and think that Kohler cannot see the photos taken by the camera.

A Kohler representative did not respond to questions from TechCrunch, but a company “privacy contact” told Fondrie-Teitler that user data is “encrypted at rest when stored on the user’s mobile phone, toilet fixture and our systems.” The company also said that “data in transit is also end-to-end encrypted as it travels between the user’s devices and our systems, where it is decrypted and processed to provide our service.”

The security researcher also pointed out that since Kohler can access customer data on its servers, it is possible that Kohler is using images of customers’ bowls to train the AI. Citing another response from the company representative, the researcher was told that Kohler’s algorithms “are only trained on de-identified data.”

Decoda costs $599 plus a mandatory subscription of at least $6.99 per month.

See the latest revelations on everything from agent AI and cloud infrastructure to security and more from the flagship Amazon Web Services event in Las Vegas. This video is brought to you in partnership with AWS.