Anker found itself in a major debacle for its Eufy security cameras that were caught uploading footage from users’ cameras to the cloud without their consent, as discovered by information security consultant Paul Moore back in November. The biggest problem was that user content uploaded from Eufy cameras was accessible through media players like VLC for others to watch. Anker said his cameras used end-to-end encryption with all content stored locally and only sent to devices on the user’s home network.
After months of uncertainty, Anker has finally admitted that its Eufy cameras weren’t encrypted as originally claimed, and that the company is working to fix the issue. In a series of emails to The limitAnker’s head of global communications Eric Villines explains that the company is currently updating every Eufy camera to use the WebRTC API to fully encrypt video footage via AES and RSA algorithms.
Today, based on industry feedback and out of an abundance of caution, the eufy Security web portal now prevents users from entering debug mode, and the code has been hardened and obfuscated. Also, the content of the video stream is encrypted which means that these video streams can no longer be played on third party media players like VLC.
Today, all video (live and recorded) shared between a user’s device and the eufy Security web portal or eufy Security app uses end-to-end encryption, which is implemented using AES and RSA algorithms. – Eric Villines, Head of Global Communications at Anker
Anker says the issue is under control and all stream requests will now be end-to-end encrypted. Additionally, Anker has publicly apologized for its lack of transparency and has hired independent security audit firms to help improve Eufy’s products and practices.
Start a new Thread