The “end-to-end encrypted” smart toilet camera is not actually end-to-end encrypted

Earlier this year, household goods maker Kohler It launched a smart camera called Dekoda Which comments on your toilet bowl, takes pictures of it, and analyzes the images to advise you about your bowel health.

Anticipating privacy concerns, Kohler said On its website Dekoda’s sensors only see what’s down the toilet, and it claims that all data is secured through “end-to-end encryption.”

The company’s use of the expression “End-to-end encryptionHowever, it is wrong, says security researcher Simon Fondry Tytler He noted in a blog post Tuesday.

By reading Kohler privacy policyThe company is clearly referring to the type of encryption that secures data as it travels over the Internet, known as TLS encryption — the same encryption that powers HTTPS websites.

Use correct terminology matters, especially in the context of concerns about user privacy. Using the expression end-to-end encryption — widely adopted in messaging apps like iMessage, Signal, and WhatsApp — to describe TLS encryption is wrong, and can confuse users who see the expression into thinking that Kohler can’t actually see the images the camera is taking.

A Kohler spokesperson did not respond to TechCrunch’s questions, but the company’s “privacy contact” told Fondrie-Teitler that user data “is encrypted at rest, when it is stored on the user’s mobile phone, the restroom facility, and on our systems.” The company also said that “data in transit is also end-to-end encrypted, as it travels between user devices and our systems, where it is decrypted and processed to deliver our services.”

The security researcher also noted that since Kohler has access to customer data on its servers, Kohler could potentially use customer photos to train its AI. Quoting another response from a company representative, the researcher was told that “Koehler’s algorithms were trained on de-identified data only.”

Decoder Costs $599 plus a mandatory subscription of at least $6.99 per month.