Your camera was never defended. The new guide just says it out loud.

The Wall Street Journal spent its Sunday personal-tech package on a single piece of instruction: how to keep the security camera in your driveway, your living room, your nursery out of the hands of the people who are constantly trying to get into it. The honest reaction is the one most people will have — a nod, a mental note, and no change in behavior. That reaction is worth pushing on, because the guide is not describing a hypothetical attack. Read it as reassurance and you have misread it. Read it as a confession and it says exactly what it is.

It opens by observing that residential camera systems often ship with default passwords and security codes that are easily found online. Not hard to guess — found, the way a number is found in a phone book. Nobody chose that password. It arrived with the device, identical on every other unit off the same line, and it is published. The manufacturer delivered your front door with the key taped to the outside, and the guide’s remedy is that you should walk over and type in a different one.

Then it escalates. Every person with access to the system should have their own credentials, it says, so that every access links to a specific person. A camera sold as a way to watch your own house is now a system you are instructed to administer like a small company, with an access-control policy and an audit trail. You need the audit trail because when the feed turns up somewhere it shouldn’t, someone is going to want to know whose credentials opened the door.

Next: multifactor authentication. Even if someone steals or guesses a password, an extra code sent to a phone or email — or supplied by an authenticator app — stands between them and your camera. True, and also an admission. The password, the thing the entire security of the device was supposed to rest on, was never sufficient on its own. The second lock exists because the first one gets picked so routinely that it stopped counting as a lock. Given that the guide’s own threat model is a stolen or guessed password, this is the single highest-return setting on the device.

The sharpest line in the guide is the buying advice, and it comes from Paul Marrapese, a California cybersecurity specialist who has researched hacked webcams: when you buy your first camera or replace one, stay away from cheap or unfamiliar brands. Established manufacturers, he says, have reputations to protect and roll out updates when problems surface. With smaller, often cheaper internet sellers, the risk is greater that flaws never get fixed or that cameras sit easily exposed on the web. Translate that into money: the difference between a camera that gets patched and a camera that stays open forever is a few dollars at checkout, and the guide is telling you to pay it. Pay it. And understand what the unpurchased patch leaves behind — as millions of home devices already demonstrate, an abandoned camera is not only a window into your living room. It is bandwidth someone else is using, and the neighborhood of compromised devices it sits in is the same neighborhood scanning for your router tonight. A camera you never patched is an asset you did not know you had donated.

The Journal’s framing is that a home’s protection is only as strong as its weakest link, and for once that phrase is not doing much rhetorical work — it is close to literal. Nearly every camera joins the household Wi-Fi, which means your camera sits on the same network as the laptop with the banking session on it. The guide also notes that a device’s built-in security features can often be activated by toggling a few settings. Toggling. The entire defensive posture of the American living room, and the word the guide reaches for is the one you use for a light switch.

None of this is precaution against a theoretical threat. The guide’s premise is that hackers are perpetually trying to break into these devices, and a visual investigation by the same newspaper found that some of them are accessed to aid warfighters. The contest over cameras extends beyond the driveway — documents reveal US law enforcement concerns over Meta smart glasses. Your baby monitor and a battlefield sensor are now neighbors in the same catalog of targets.

Which is why the guide’s real subject is not how to protect your camera. It is the size of the hole the camera shipped with. Change the password that came in the box. Give every relative their own credentials. Turn on the second factor the factory left off. Keep the firmware current on a schedule the seller may never keep. Every sentence is a repair bill for something that should never have left the warehouse broken — and the bill is being mailed, as always, to you. Most of it is toggling a handful of settings. The people who skip it are not making a considered tradeoff. They are assuming the box was configured by someone who cared about them, and the box was configured by nobody in particular.