Anker Admits Eufy Cameras Did Not Offer End-to-End Encryption as Promised, Pledges to Do Better

[MacRumors]

Back in November, Anker's Eufy brand made headlines after security consultant Paul Moore discovered that Eufy security cameras were sending data to the cloud, even when cloud storage upload settings were disabled. Further, Eufy camera streams were allegedly able to be watched live through an app like VLC, which presented a glaring security issue.

That the Eufy cameras were uploading content to the cloud was problematic because Anker has long touted the security of its Eufy devices, claiming that they feature local-only storage and end-to-end encryption for those who want a more private camera solution. Following this debacle, The Verge began trying to get answers about Eufy camera security from Anker, and Anker was providing deliberately unclear and often misleading answers about how Eufy cameras worked.

The Verge was finally able to get answers from Anker by threatening to publish a story about the company's lack of communication, which has led to some clarification about Eufy security. Eufy cameras do not offer native end-to-end encryption, and they did indeed provide unencrypted video streams through the Eufy web portal, though Anker says this is an issue that has now been fixed. From Eufy:

Previously, after logging into our secure Web portal at eufy.com, a registered user could enter debug mode, use the Web browser’s DevTool to locate the live stream, and then play or share that link with someone else to play outside of our secure system. However, that would have been the user’s choice to share that link, and they would have needed to first log into the eufy Web portal to get this link.

Today, based on industry feedback and out of an abundance of caution, the eufy Security Web portal now prohibits users from entering debug mode, and the code has been hardened and obfuscated. In addition, the video stream content is encrypted, which means that these video streams can no longer be played on third-party media players such as VLC.

I should note, however, that only 0.1 percent of our current daily users use the secure Web portal feature at eufy.com. Most of our users use the eufy Security app to view live streams. Either way, the previous design of our Web portal had some issues, which have since been resolved.

Video stream requests originating from the Eufy web portal will be end-to-end encrypted going forward, as they are with the Eufy app, which Anker says is the primary way that Eufy users access camera streams. Anker says that every Eufy camera is being updated to use WebRTC, which is encrypted by default, and it will no longer be possible to play Eufy video streams through third-party apps.

Anker was regretful about its lack of communication, and said that it would do better in the future. The company is bringing in third-party security companies to audit the Eufy security products, and it is working on an official bug bounty program. Anker will also establish a security micro-site in February, and will provide customers with more information on the changes that have been implemented.

For those who are interested in the full details of what Eufy has to say, The Verge published its complete email communications with Anker spokespeople.

Article Link: Anker Admits Eufy Cameras Did Not Offer End-to-End Encryption as Promised, Pledges to Do Better

 

[now i see it]

Its reassuring than Anker is a trustworthy company now

 

[Leon Ze Professional]

Simply not acceptable! Shouldn't need a disaster to get your house in order.

 

[erikkfi]

Now that you've caught us in an out-and-out lie about the security of our products, please continue to use them and we promise this time we'll do better.

 

[yukari]

I can see a class action suit coming miles ahead.

 

[TheYayAreaLiving 🎗️]

If this was Apple there would be a lawsuit instantly. They are lucky they are getting away with it for now.

 

[TheWatchfulOne]

And I pledge not to buy any Eufy cameras or any other camera solution that hogs up your WiFi and/or stores your footage in the cloud.

 

[antiprotest]

"I should note, however, that only 0.1 percent of our current daily users use the secure Web portal feature at eufy.com."

Right. Those are the people hacking into the users' accounts.

 

[hortod1]

"I should note, however, that only 0.1 percent of our current daily users use the secure Web portal feature at eufy.com."

Right. Those are the people hacking into the users' accounts.

Beat me to it

 

[Pezimak]

Hmm were people on here so unforgiving when it was discovered, thanks to a British newspaper and a whistle blower, Apple contracted a third party company to listen to all your Siri interactions, and that Siri recoded you having sex or conversations you didn’t want others to hear without your knowledge?

Seems the same to me here, glad Anker have fixed the issue but as they said it affected such a small user base as most users don’t use their online subscription service.

 

[jarman92]

HomeKit Secure Video is a criminally overlooked Apple product.

 

[russell_314]

HomeKit Secure Video is a criminally overlooked Apple product.

I don’t understand why more people don’t use it. I’ve been looking for a indoor camera with it and there doesn’t seem to be many good choices.

 

[twistedpixel8]

 

[jarman92]

I don’t understand why more people don’t use it. I’ve been looking for a indoor camera with it and there doesn’t seem to be many good choices.

Eufy cams actually allow you to use it, you just have to enable it in the Eufy app and you lose some features. It's why I'm not that mad about this lol

 

[twistedpixel8]

I don’t understand why more people don’t use it. I’ve been looking for a indoor camera with it and there doesn’t seem to be many good choices.

Because it is unreliable - as with most things HomeKit. I will often get notified of motion but it doesn’t actually bother to record. Then I check the third-party camera app and that recorded the event just fine.

 

[profets]

HKSV isn't perfect, but for me works quite well, and nice being able to use HomeKit Accessory Security to prevent those devices from communicating outside of the local network.

 

[russell_314]

Because it is unreliable - as with most things HomeKit. I will often get notified of motion but it doesn’t actually bother to record. Then I check the third-party camera app and that recorded the event just fine.

I thought you could use it without the third-party camera app? If you still have to run it through whatever brand’s app, I don’t see the point.

What camera do you have? For an indoor camera I want would want one that’s powered so it records all the time. Those battery powered cameras are kind of cool but they only record when triggered so I don’t think they are ideal.

 

[LogicalApex]

Because it is unreliable - as with most things HomeKit. I will often get notified of motion but it doesn’t actually bother to record. Then I check the third-party camera app and that recorded the event just fine.

How would there be a third party app to check with HSV? It has to be E2EE which would prevent a third party app from recording. Unless I am misunderstanding HomeKit secure video.

 

[kesenwangs]

I thought you could use it without the third-party camera app? If you still have to run it through whatever brand’s app, I don’t see the point.

What camera do you have? For an indoor camera I want would want one that’s powered so it records all the time. Those battery powered cameras are kind of cool but they only record when triggered so I don’t think they are ideal.

The Eufy cams some of them are so sketchy, like there isn’t even a HomeKit code. You have to link it to HomeKit through their app. I only have one but I’d never buy another.

 

[russell_314]

Anyone using this Chinese garbage was asking for trouble -- the way they worded their response insinuates that Anker/Eufy employees can still access the streams, you just can't share it with anyone. Crazy.

I agree it is not private. If they want to hook into my camera, they’re going to be really bored. Right now I have a cheap Walmart special that I suspect it’s a little less private than Anker 😂

 

[russell_314]

The Eufy cams some of them are so sketchy, like there isn’t even a HomeKit code. You have to link it to HomeKit through their app. I only have one but I’d never buy another.

Yeah, I don’t think I would get something that requires the app because that kind of defeats the purpose. At least the privacy portion of it. I don’t think I would trust in Anker/ Eufy camera unless I could operate it without the app. They make awesome chargers and cables, but I don’t know about the camera.

 

[jarman92]

I thought you could use it without the third-party camera app? If you still have to run it through whatever brand’s app, I don’t see the point.

What camera do you have? For an indoor camera I want would want one that’s powered so it records all the time. Those battery powered cameras are kind of cool but they only record when triggered so I don’t think they are ideal.

You can use both, at least with Eufy. AFAIK HomeKit doesn’t support certain features like panning, so you can see the feed in Home and get the benefits of HKSV while still being able to move the camera with the Eufy app.

 

[AgentOSX]

I am just waiting for my Eufy footage of me making coffee naked to become a thing.

 

[jchap]

Simply not acceptable! Shouldn't need a disaster to get your house in order.

Actually, a disaster is often exactly what it takes for companies—and for people—to get their house in order. Something called complacency, I believe...

 

[7thson]

and it will no longer be possible to play Eufy video streams through third-party apps.

Does this mean HomeKit will not be supported going forward?