Anker's Eufy Cameras Caught Uploading Content to the Cloud Without User Consent [Updated]

[msfdc]

"We are revising the push notifications option language in the eufy Security app to clearly detail that push notifications with thumbnails require preview images that will be temporarily stored in the cloud."

Anker is still lying.
Obviously the images were uploaded with device information and facial recognition data at the time when an event was triggered.
The behaviour doesn't change even you choose text only notification.
I have confirmed that with my own eufycams and homebase.

 

[mike090910]

So the basic solution from Anker is well this time you found out what we were up to. But to just stay away from Naker products for security, unless you want the everyone to see what is going on.

 

[hoo-man-b-ing]

Interesting updates.

Some things worth noting:
- if it turns out that Anker violated GDPR, they could be looking at massive fines (Amazon and WhatsApp have both been fined for $746million and $225 million respectively.)
- If the video is stored locally, I don’t believe there’s any need for them to even store a preview thumbnail in the cloud. Whether you want to chalk that up to “bad coding” or “intentionally abusing customer trust for an inefficient way of delivering functionality” is up for debate. I’m also curious if they transmit (but not store) video out of your local network so that a server-side process can pick the ideal key frame for the thumbnail for those push notifications. This would make their latest statement technically correct (“all video is stored locally”) but in a way that would still be susprising to many customers.

 

[Pezimak]

So basically this Moore chap was after click bait hyperbole revenue, and it looks like it worked.
Love my Eufy system, does a good job. Tempted by their new AI system too.

 

[Pezimak]

This is one reason that I don't like these kinds of internet/cloud devices. We have no Siri/Alexa/Google speakers in the house, no internet-enabled camera, etc. We do have an internet enabled thermostat which is about the only item of this kind we have except....a weak spot in our system is we do have "Hey siri" turned on for the iPhones and iPads which, I suppose, is akin to having internet-enabled speakers. I have trusted Apple with privacy issues, but wonder if I need to rethink all of this...

So you make a post complaining about smart speaker and AI assistant security risks... then gleefully announce you DO use Siri? 🤣😂 Siri, the assistant Apple failed to inform all its users of that their recordings were being listened to by contractors in Ireland.. its entire privacy image is as secure as Eufy's cameras, probably less so, they didn't tell anyone about Siri recordings being listened to so what else do they choose not to inform you off?

 

[JM]

I buy it. That seems like a genuine apology for an over site.

 

[JM]

I heard there are little Chinese people inside the chargers. who send personal information back to china.

Straight to video: “Honey I Shrunk the CCP”

Coming soon to a living room near you

😆

 

[drumcat]

UPDATE: Yep, busted.

 

[Pezimak]

Made in China by Chinese company. What did you expect.

Everything Apple sells is made in China? What's your point? And let's not forget Apple never told us that a third party in Ireland was listening to all your Siri interactions.. including when it activated without you knowing. Is that China's fault too?

 

[kirbyrun]

Oh no, how is this a thing

Right???

Was looking for tiny cameras on eBay once for a video project and came across ‘em. There are also ones in light bulbs.

 

[PauloSera]

"No clouds or costs" is not "some clouds or costs." I'm tired of seeing people come to Anker's defense on this today. They EXPLICITLY promote no cloud connectivity, and they definitely DON'T promote individual, traceable facial recognition data across the entire Eufy ecosystem.

Period, end of story.

You don't get it, that's fine.

 

[Bawstun]

The update from Ankr is exactly how matters like this should be handled. Admit the mistake, and communicate how you will fix it going forward. Clear-
-cut, no games, no excuses.

Please take note, Apple.

 

[mikegoldnj]

Yes you can add it to HomeKit but it disables some capabilities like getting notifications based on sound or movement.

I have 2 Eufy outdoor cams set up on HomeKit and I am able to get notifications based on movement.

 

[Unregistered 4U]

What do you mean by this? The "test" shown in the article was horrible and wasn't done correctly. He doesn't even bother to log out until AFTER he triggers another event. Just complete rubbish of a test procedure. The response by the MFG shows directly what the "issue" is and how to stop it.

Yeah, just another “security researcher” that goes into the “ignore” pile. But, I mean, it’s to be expected. If this researcher was making good money researching for companies/individuals, then they wouldn’t have the time to put out rushed videos.

 

[Arsenikdote]

Interesting updates.

Some things worth noting:
- if it turns out that Anker violated GDPR, they could be looking at massive fines (Amazon and WhatsApp have both been fined for $746million and $225 million respectively.)
- If the video is stored locally, I don’t believe there’s any need for them to even store a preview thumbnail in the cloud. Whether you want to chalk that up to “bad coding” or “intentionally abusing customer trust for an inefficient way of delivering functionality” is up for debate. I’m also curious if they transmit (but not store) video out of your local network so that a server-side process can pick the ideal key frame for the thumbnail for those push notifications. This would make their latest statement technically correct (“all video is stored locally”) but in a way that would still be susprising to many customers.

Did you see the update to the story?

 

[fredn]

Good work Paul Moore!

 

[Arsenikdote]

I have 2 Eufy outdoor cams set up on HomeKit and I am able to get notifications based on movement.

Everyone's situation and experiences are different. I have had a couple different versions of the outdoor eufy cameras. Before HomeKit was a feature I regularly got updates from the cameras and they seemed to detect motion quite well. I wished the recordings would start slightly sooner, but that was my only complaint. I then tried using HomeKit's Secure Video. While technically they support movement notifications and recordings, my experience with it was terrible. I got maybe 1/5th of the notifications. Often times I would get packages and no recording of any movement at all. This never happened once with the eufy app when it was not connected to HomeKit. Looking online my experience is not unique. Apple is trying to do video analysis and whatever that process is does not work as well as the on-board processing that eufy can do on their own. Since currently it is either/or, I have disabled my exterior cameras from HomeKit and left my interior cameras on HomeKit.

 

[haruhiko]

I have 2 Eufy 2K Pan & Tilt camera at home which doesn't need a HomeBase. After connecting it with HomeKit, the app told me that the AI recognition will be done by Apple instead of their own server. So i'm not sure if this means that they are still getting my data or not. I assume it to be yes.

 

[Xano]

on this days we can't trust any company anymore, everyone wants to spy on you and sell it, since the mega data breach I sold all my Anker Eufy stuff and seams time gave me reason.
This is a company who promise stuff and don't deliver them, also they are super arrogant and only see money and growth numbers, costumers for them are pure garbage.

 

[msackey]

It's beginning to seem like the IoT world isn't designed so much for the person who buys the devices as for the companies that make the devices (and anyone who can hack into them).

I’ve had fears that these IoT have side aim of benefiting the companies that make them by providing raw data for their future improved audio and video recognition and big data gathering. No thank you.

 

[msackey]

So you make a post complaining about smart speaker and AI assistant security risks... then gleefully announce you DO use Siri? 🤣😂 Siri, the assistant Apple failed to inform all its users of that their recordings were being listened to by contractors in Ireland.. its entire privacy image is as secure as Eufy's cameras, probably less so, they didn't tell anyone about Siri recordings being listened to so what else do they choose not to inform you off?

If you read the post carefully, it begins with a logic which I also say I have to rethink because there are holes in it. At one point I did trust Apple’s privacy practice more, but not so sure about that now.

Re-read the post. It’s a post that’s about having to rethink privacy and security because times have continued to change.

 

[SteveJawbs]

Amazon and Apple have been legitimately caught hoarding data from Alexa and Siri. Both incidents widely documented. I’m convinced my Arlo cameras are documenting my life everyday. I with I knew someone that worked there to know the truth. ;-) It creeps me out for sure. There is a lot we don’t know. Anything IOT made in China should be looked at with more distrust than trust ultimately.

 

[seek3r]

Anker’s update on the thumbnails makes a lot of sense, given the push notifications have to be handled somewhere.

I’m more concerned with the apparent bug in accessing the stream locally…

 

[svish]

Very bad. One starts to loose trust in the brand.

 

[3460169]

[...]

Tim Cook, sitting in One Infinite Loop, is like:

View attachment 2120836

Ahaha, I love a good Matrix reference, and this one is most excellent and appropriate for the subject matter! Well played!