Many camera manufacturers programmed a backdoor parameter. If the URL contained mode=motion and verified=1 or verified=true , the server would serve the JPEG or MJPEG stream without prompting for a username or password. This was intended for third-party apps, but became a massive liability.